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FOREWORD 


This  report  was  pro  pared  by  North  American  Rockwell  Corporation  for  tha 
Structures  Division,  Air  Foroa  Flight  Dynamics  Laboratory,  Wright-Patterson 
Air  Korea  Base,  Ohio,  under  Air  Korea  Contract  So*  AF33{6l5)-3755,  Project 
Ho.  1367,  "Structural  Design  Criteria,"  Task  Ho.  136714,  "Structural  Loads 
Criteria  Simulation  Techniques." 

The  study  and  analysis  on  which  this  report  is  based  are  work  accomplished 
by  the  Methods  and  Criteria  Unit  of  the  Structures  and  Design  Department  in  the 
Space  Division  of  North  American  Rockwell  during  the  period  from  April  1966  to 
May  1967.  Mr.  H.  Fisk  was  Program  Manager  for  North  American  Rockwell. 

Mr.  George  E.  Muller  of  the  AFFDL  (FDTR)  was  the  Project  Engineer.  Permission 
to  reproduce  a  portion  of  the  paper,  "The  Role  of  Infonaetics  in  Modem  Flight 
Systems,"  by  Professor  C.  S.  Draper  has  bean  granted  by  the  Journal  of 
Spacecraft  and  Rockets. 

The  contractor's  designation  of  this  report  is  BD  67-495-1,  Uhl*  report 
was  submit tad  by  the  authors  in  February  1968, 

Publication  of  this  report  does  not  constitute  Air  Force  approval  of 
the  report's  findings  or  conclusions.  It  is  published  only  for  the  exchange 
and  stimulation  of  ideas. 
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abstract 


Exploratory  research,  needed  to  develop  quantitative  structural  design 
ortUrlt  for  aerospace  vehicles,  ha*  bean  conducted  to  rele te  the 
probabilistic  nature  of  design,  operational,  and  environmental  experiences 
to  tho  atruotural  performance  of  eeroapaoa  vahialea.  This  design  criteria 
la  predicated  on  the  ccneapt  of  structural  r* Liability.  Volume  I  presents 
a  critique  of  present  and  propoaad  approaches  to  structural  design  criteria. 
Volume  II  presents  raouten  lit  lone  for  a  deterministic  structural  design 
criteria  procedure  baaed  on  statistical  methods.  This  la  a  n aw  procedure 
intended  to  overcome  tha  problem  associated  with  other  structural  design 
criteria  procedures.  Tha  new  procedure  la  demonstrated  on  the  F-100 
airplane  by  comparing  the  output  of  the  computer  program  with  actual  service 
records.  Volume  III  fonmalatas  two  computer  program  for  tha  procedure  and 
presents  user's  instructions  for  tha  program. 

The  critique  of  Volume  I  concludes  that  none  of  the  approaches  in  the 
literature  today  provides  a  satisfactory  foundation  for  quantitative 
structural  design  criteria  based  on  statistical  orthoda. 

This  document  is  subject  to  special  export  controls  and  each  transmittal 
to  foreign  nationals  or  foreign  governments  may  be  made  only  with  prior 
approval  of  tbs  Air  Force  Flight  TJymedcs  laboratory  (FDTR),  Wrlght-Patterson 
AFB,  Ohio  43433. 
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SECTION  I 


IHTBODDCTIOH 


The  need  to  relate  structural  design  criteria  to  structural  reliability 
has  bean  recognised  for  many  years.  For  Instance,  Pugsloy,  in  Reference  1, 
presented  one  of  the  earliest  known  discussions  of  the  statistical  approach 
to  structural  design.  However,  all  past  att  septa  at  imposing  a  quantitative 
structural  reliability  requirement  have  been  rejected  by  those  most  directly 
responsible  for  the  structural  design  of  operational  vehicles. 

Ifach  of  the  previous  work  can  be  characterised  by  the  naivete  with  which 
the  structural  reliability  problem  is  approached.  Most  investigators  confuse 
the  ability  to  calculate  the  probability  of  failure  when  load  and  strength 
spectra  are  assumed  to  be  known  with  the  ability  to  determine  the  true  struc¬ 
tural  reliability  of  an  operational  structural  systasi.  Part  of  the  difficulty 
is  that,  when  the  problem  is.  formulated  in  such  a  way  that  it  can  be  solved 
rationally,  it  is  oftaa  simplified  to  the  point  where  the  problem  is  no  longer 
rational.  Too  often,  procedures  that  appear  to  offer  solutions  to  structural 
reliability  problems  are  unworkable  because  they  oadt  one  or  more  of  the  basic 
elements  of  the  problem.  Procedures  actually  used  in  the  design  of  aircraft, 
as  exemplified  by  MIL-A-8860  and  its  predecessors,  have  included  many  such 
elements  without  explicit  recognition.  Thus,  such  elements  are  easily  over¬ 
looked  by  those  who  are  attempting  to  formulate  solutions  to  structural 
reliability  problems.  It  is  believed  that  unsatisfactory  experience  with 
making  radical  changes  in  the  method  of  solving  a  problem  underlies  much  of 
the  reluctance  of  practicing  engineers  to  blithely  adopt  proposed  new  ideas. 

In  the  case  of  statistical  approaches  to  structural  reliability,  some 
of  the  considerations  that  appear  to  be  overlooked  are  the  fact  that: 

1.  Errors  or  discrepancies  often  occur  between,  the  actual  and 
the  calculated  spectra. 

2.  The  powerful  effect  of  testing  as  a  means  of  disclosing 
errors  is  not  fully  exploited. 

3.  The  necessity  for  a  procedure  for  demonstrating  proof  of 
compliance  with  the  requirements. 

4.  The  requirement  for  assignment  of  responsibility  for  certain 
actions  which  are  necessarily  associated  with  any  determination 
of  structural  reliability. 

The  study,  described  in  the  three  volumes  of  this  report,  is  intended  to 
accomplish  the  exploratory  research  needed  to  develop  quantitative  structural 
design  criteria  for  aerospace  vehicles  that  will  relate  the  probabilistic 
nature  of  design,  operational,  and  environmental  experiences  to  the  struc¬ 
tural  performance.  This  design  criteria  io  predicated  on  the  concept  of 
structural  reliability.  Volume  I  of  the  report  presents  an  evaluation  of 
existing  and  proposed  approaches.  Volume  II  presents  the  recoamndations 
for  a  deterministic  structural  design  criteria  procedure  based  on  statistical 
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methods.  This  is  a  nw  procedure  intended  to  overcome  tht  problems  associated 
with  other  structural  design  criteria;  procedure*.  Tbs  new  proesdure  is 
d  anon  art  rated  en  the  F-100  airplane  by  compering  the  output  of  the  reap  liter 
program  with  actual  sarrioe  records.  Volume  III  .onailates  a  computer 
program  for  the  procedure  and  presents  uesr'e  inet ructions  for  the  program. 

Tha  first  parties  of  the  shady,  rsevaviab  herein  aa  Fnlnmrt  I.  tekes  up 
th*  problem  of  evaluating  the  various  approaches  to  structural  design  criteria 
in  threw  major  steps*  The  first  of  these  step*  is  to  develop  *  clear  under- 
siaodlug  of  the  various  functions  that  contribute  to  a  structural  design 
system.  This  understanding  is  aided  by  extending  the  application  of  the  con¬ 
cepts  prrcBciws  by  Draper  in  Eefersace  2  to  structural  design  cyctess.  The 
purpose  of  any  structural  design  system  is  the  Croatian  of  an  operational 
structural  aye  tan  that  will  enable  ths  vehicle  to  satisfactorily  per  for*  its 
si sal on.  Whan  the  contributions  of  the  various  functions  comprising  tha 
structural  design  systsai  are  understood,  better  procedures  can  be  established 
to  fulfill  these  functions . 

Ths  second  step  is  to  evaluate  two  general  structural  design  systsns  to 
detsmins  how  well  they  perform  the  functions  established  in  ths  first  step. 

One  of  these  generalised  systems  is  ths  Present  (Factor  of  Safety)  Structural 
Design  System.  This  gyslets  represents  the  structural  design  procedures  and 
the  state  of  the  art  as  it  exists  today.  Tha  other  generalised  systen  is  a 
Purely  Statistical  Structural  Be liability  Systesu  This  represents  e  hypo¬ 
thetical  system  which  establishes  s  structural  reliability  number  as  the 
basic  requirement  of  the  structural  system.  Standards  for  the  evaluation  of 
these  two  systems  are  established  in  this  second  step.  These  sens  standards 
become  the  basis  for  formulating  the  new  procedure  presented  in  Volume  XI  of 
this  report. 

The  third  step  is  to  evaluate  a  group  of  papers  considered  to  be  a 
representative  cross  section  of  ths  structural  reliability  methods  extent  in 
the  technical  literature.  These  pepers  are  evaluated  by  the  sane  standards 
used  to  evaluate  the  two  generalised  systems  in  the  second  step. 

The  identification  of  the  desirable  features  together  with  the  problems 
in  the  existing  and  proposed  structural  design  systems  as  identified  in  this 
Volume  I  provides  the  basis  for  the  development  of  a  new  system.  This  new 
system,  described  in  Volumes  IX  and  XXI,  will  attaspt  to  Incorporate  the 
desirable  features  and  to  overcome  ths  problems  as  identified  in  Volume  I. 
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UNDERSTANDING  THE  FUNCTIOiS  OF  A 
STRUCTURAL  DESIGN  ST 3 TEH 


2.1  INTRODUCTION 

Publication  of  a  p*p*r  by  Professor  C.  Stark  Draper  of  MIT  haa  provided 
an  intriguing  nav  framework  for  developing  a  better  understanding  of  the 
structural  design  problem.  Draper's  paper,  "The  Role  of  Informatics  in  Modern 
Plight  Systems,"  was  first  presented  as  the  29th  Wright  Brothers  Lecture.* 
later  it  was  published  in  the  learns}  gf  Ss-ssscrsit  gaa  iuA»ket».  This  paper 
haa  all  of  the  earmarks  of  &  classic.  It  ia  suggested  as  recommended  reading 
for  all  knowledgeable  structural  engineers. 

Although  Draper's  presentation  is  given  in  terms  of  stabilisation  and 
control  rysteaa  for  flight  vehicles,  his  principles  are  universal.  Draper 
himself  points  this  out  in  the  last  paragraph  of  his  paper.  "It  is  iapor- 
tent  to  note  that  the  functional  pattern  discussed  in  the  pap*  •»  may  be 
applied  not  only  to  flight  vehicles  but  to  operating  systems  eu  all  kinds 
ranging  from  single  human  beings  to  industrial  complexes,  armies,  and  whole 
nations.  Clear  understanding  of  the  functional  relationships  involved  ia 
surely  a  vary  useful  factor  in  achieving  optimal  results  from  any  system. 

The  concepts  discussed  in  the  paper  represent  new  concepts  that  auraly  will 
be  helpful  for  the  realisation  of  this  goal."  It  appears  that  an  extension 
of  Draper's  concepts  to  the  structural  design  system  provides  a  perfect 
rationale  for  understanding  shat  we  are  trying  to  do  in  structural  design  and 
wny. 


In  the  development  of  his  informatics  thesis.  Draper  starts  with  a  dis¬ 
cussion  of  the  Wright  Flyer.  He  points  out  that  the  "Wright  brothers  pioneered 
greatly  in  recognising  that  the  sensing,  processing,  and  application  of  infor¬ 
mation  to  the  control  of  the  airframe  and  its  propulsion  ayatam  was  not  an 
incidental  matter  but  really  filled  rolea  as  essential  as  those  played  by 
wings,  engine,  propellers,  and  auxiliary  surfaces."  The  airframe  is  essen¬ 
tially  the  structural  eystea.  It  ia  apparent  that  tae  Wright  brothers  under¬ 
stood  that  control  of  the  structural  system  was  a  vital  part  of  the  develop¬ 
ment  of  a  good  vehicle  ayotem.  A  specific  instance  of  this  understanding  is 
their  structural  design  criteria.  As  indicated  by  the  quote  in  Reference  3, 
they  astabliahed  their  objective  as  a  structural  system  that  would  sustain 
five  times  the  weight  of  the  vehicle  and  they  took  steps  to  implement  this 
objective.  This  present  report  will  show  how  similar  concepts  can  be  applied 
to  current  structural  design  problems. 

2.2  THE  INFORHETICS  CONCEPT 

The  discussion  of  the  informatics  concept  is  so  wall  done  in  Draper's 
paper  that  it  appears  better  to  directly  reproduce  those  parts  of  the 
original  text  that  develop  that  concept  rather  than  trying  to  rewrite 
Draper's  words.  This  reproduction  is  with  the  permission  of  the  Journal  of 
Spacecraft  and  Rockets. 
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a .  General  Background 


ENVIRONMENT 


Environment  for  mankind  is  the  total  complex  of  all  the 
things  with  which  direct  or  indirect  interactions  may  occur. 
Ia  general,  the  environment  is  made  up  of  so  many  factors 
that  to  consider  all  of  them  simultaneously  is  manifestly 
impossible.  This  means  that,  in  dealing  with  activities 
directed  toward  producing  desired  interactions  with  the 
environment,  some  rogion-of-interett  having  a  manage¬ 
able  site  is  selected  and  blocked  out  for  concentrated  atten¬ 
tion.  A  region  of  this  sort  is  suggested  in  Fig.  1  where  the 
real-world  rtuation  of  complete  enclosure  is  shown  by  the 
somewhat  amorphous  boundaries.  Any  factors  not  singled 
out  for  special  attention  remain  with  the  environment. 

Figure  2  represents  the  situation  when  the  region-of- 
interest  ia  a  conceptual  operating  system  to  supply  inter¬ 
actions  with  the  environment  which  are  imagined  to  be 
desirable.  Again,  the  environment  completely  surrounds 
the  region-of-interest  so  that  any  inward  drawn  arrow  repre¬ 
sents  an  input,  whereas  any  outward  drawn  arrow  into  the 
environment  ia  an  output.  Thin  arrows  represent  a  flow  of 
information,  often  in  the  form  of  signals,  whereas  broad 
arrows  suggest  relatively  high  power,  great  force,  or  comider- 
able  flow  rates  of  materials.  Intermediate  width  arrows 
would  show  intermediate  levels.  Any  human  activity  toward 
the  final  realisation  of  an  operating  system  must  begin  with 
the  imagination  of  desired  results.  With  these  results  in 
mind,  imagination  should  call  up  the  concept  of  a  proper 
effector  to  receive  inputs  from  the  environment  and  to  gener¬ 
ate  the  desired  results.  In  Fig.  2,  the  initiating  Imagination 
and  Desires  element  is  represented  by  a  box  in  the  lower 
left-hand  comer  of  the  region-of-interest,  whereas  the  effector 
is  shown  with  its  environmental  inputs  and  outputs  in  the 
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Fig.  2  Functional  diagram  for  conceptual  operating 
•ystem  to  supply  desired  results. 


V}p.  )  ftcjrion  of  interest  aa  a  generalised  concept. 


upper  right-hand  comer  of  the  region.  Before  significant, 
results  can  be  expected  in  practice,  clearly  defined  functional, 
operating  chains  must  exist  between  the  two  boxes.  In 
practice,  the  components  that  act  as  links  in  these  chains  will 
be  different  for  each  system  considered,  but  it  is  always 
possible  to  identify  two  regions  of  distinctly  different  char¬ 
acteristics  and  a  third  region  with  the  general  nature  of  an 
interface.  To  clarify  discussions,  to  provide  general  guide 
lines  for  drawing  diagrams,  and  to  stimulate  advanced  de¬ 
velopments,  the  three  fields  that  include  all  the  elements  of 
ansc  operating  system  are  as  follows.  1)  Effectetics:  The 
art® science,  engineering,  and  technology  of  realising  means 
for  directly  achieving  desirea  interaction*  u-ith  the  environment; 
2)  Informetics:  The  art,  science,  engineering,  and  technology 
of  collecting  and  applying  information  to  generate  operating 
instructions  for  the  realisation  of  desired  results;  and  3) 
Control  ( and  Stabilization)  (Interface  between  Informetics 
and  Effectetics):  The  art,  science,  engineering,  and  tech¬ 
nology  of  receiving  control  commands  generated  by  informe¬ 
tics  and  causing  associated  effectors  to  function  in  accordance 
with  these  commands. 

Figure  3  represents  the  over-all  complex  of  science  and 
technology  as  a  region  of  interest.  Basic  science,  under  the 
direction  of  scientists,  receives  support  from  the  environment 
to  deal  with  the  natural  laws  and  materials  of  nature  and 
produces  systematic  and  verified  knowledge  without  concern 
for  particular  applications.  Applied  science  deals  with 
generalised  applications  of  scientific  knowledge,  receiving 
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Fig.  3  Science  and  technology  aa  a  region  of  intercut. 


mi|i|x>rt  from  the  environment  to  deal  with  the  Lawn  and 
materials  of  nature  under  the  direction  of  applied  scientists. 
Technology  receives  knowledge  from  Ixith  basic  and  applied 
science,  significant  support  and  often  considerable  quantities 
of  materials  from  the  environment  to  generate  device*  and 
systems  that  operate  as  means  for  meeting  the  desires  and 
needs  of  society.  Technological  knowledge  is  supplied  to 
the  environment  as  an  incidental  output.  In  general,  engi¬ 
neers  play  roles  of  assuming  over-all  responsibility  for  the 
activities  of  technology  in  a  way  that  corres|Kmds  to  the 


Fig.  4  The  %  right  Flyer. 


|H>Kitions  accepted  by  scientists  in  their  relationships  with 
science. 

Using  the  concept*  illustrated  by  the  figures,  the  Wright 
brothers  treated  their  flyer  as  a  project  of  technology  with 
all  phases,  science,  applied  science,  and  engineering  handler! 
l*ersoaally  by  themselves.  A  revolutionary  feature  of  their 
approach  was  to  deal  with  the  circumstances  of  man-carrying 
flight  in  terms  of  a  complete  system  with  effectetics,  informe- 
tics,  and  control  integrated  into  a  single  pattern.  In  their 
time  this  was  an  unusual  mental  attitude  since  the  usual 
procedure  in  dealing  with  flying  machines  was  to  concentrate 
on  the  effector  with  complete  disregard  of,  or  very  little 
attention  directed  toward,  the  requirements  of  informetirx. 
Experience  with  bicycles,  unstable  alone  and  beautifully 
stable  and  controllable  in  the  hands  of  skilled  riders,  cer¬ 
tainly  guided  the  thoughts  of  Wilbur  and  Orv  ille  into  chan¬ 
nels  that,  with  hindsight,  we  now  know  to  have  been  extra¬ 
ordinarily  productive. 

It  is  the  purpose  of  this  paper  to  show  how  the  development 
of  informetic*  has  been  so  fruitful  for  aeronautics  and  to 


suggest  powibilitiea  in  which  this  relatively  new  fold  will 
lead  technology  to  ever  greater  levels  in  the  yean  ahead. 

b.  The  Wright  Flyer 

Figure  4  represent*  the  Wright  Flyer  above  the  **nda  »t 
Kittyhawk.  The  reclining  pilot  warped  the  wing*  to  give 
rolling  action*  by  sideways  motion  of  hi*  hijie  to  move  a  yoke, 
which  alao  worked  the  vertical  tail  to  ccmjiensate  for  yawing 
moment*  caused  by  roll.  His  left  hand  operated  the  elevator 
surfaces  carried  ahead  of  the  wings  to  adjust  climb  «nd 
deccent.  With  the  Flyer  ready  to  fly,  but  without  a  man 
in  the  cradle,  effectetics  had  certainly  done  it*  job  but  with¬ 
out  means  to  accept  information  and  supply  stabilisation 
and  control  inputs  to  the  airplane,  and  effective  flight 
impossible.  Once  a  skilled  pilot  took  his  place  at  the  con¬ 
trols  the  situation  was  entirely  changed  because  the  man 
complemented  the  inanimate  effector  by  adding  the  previ¬ 
ously  missing  element*  of  control  and  informatics.  It  is 
only  a  factual  recognition  of  the  exceedingly  great  contribu¬ 
tions  of  a  properly  educated  and  trained  human  being  to 
review  briefly  some  of  the  essential  functions  he  era*  capable 
of  fulfilling  under  proper  circumstances.  These  functions 
are  noted  in  boxes  for  the  functional  diagram  of  Fig.  5  to 
indicate  how  the  open  spaces  of  Fig.  2  might  be  filled  in  to 
represent  the  interconnections  between  imagination 
desires  to  a  flying  machine  effector  when  all  Control  and 
Informetics  functions  come  from  a  human  pilot. 

The  first  requirement  on  control  system  operation  is 
Stabilisation,  which  is  the  continuous  maintenance  of  effector 
ojieration  close  to  equilibrium  conditions  based  on  selected 
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Fig.  6  Generalised  functional  diagram  for  nlahihsation 
and  control. 
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c)  Desired  State — Actual  State  Information 


b)  Actual  Statu  Information  System.  d)  Control  Command  Generator. 

'  uriutsonF  upon  informetics  portion  of  S  in.  6  which  lean  to  the  over-aM  generalizes!  functions!  diagram  of  Ki«t.  8. 
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I  ^iafniM  lor  on  op-rrat- 
tag  *7  item 


Kromrtrical  reference*  for  tha  oootrol  (yoUoo.  The  aocixvd 
control  nyiUtg  function  w  to  transform  deviation*  between 
ttcUiftil  gfftcUtr  aUt*Uoa*  ifld  n#4©ct*d  rifirtflct  coodiUotw 
into  effector  control  system  intuit*  for  oormctia*:  at  time 
deviation*.  A  third  control  eyitw  funcUw  i*  to  rtienur 
the  stabilisation  reference*  ir  accordance  with  control 
motioned  inputs.  A *  suggested  by  Um  assail  dutches  placed 
in  the  control  system*  oon»t«a*at  “ho***"  of  Pig.  S,  the 
piiut'e  stnaea,  hie  aervM,  hie  brain,  and  hie  m one  lee  |>rovide 
ah  the  control  eyctaea  functeon*.  Mia  eyee  aee  the  earth’* 
horison  and  it*  land  maria  a*  the  geomntriral  reference*  for 
arcus  ox  deviation*  ia  stahihsatina.  Mia  body,  arms,  and 
hand  act  to  eoupk  control  *y»tnm  output*  into  the  elevator, 
win*  O'er] not,  and  rudder  ayaUuoi  of  ike  aircraft-  Hi* 
corvee  transmit  siaNliwltnn  and  control  command  infornav 
tion  to  hia  brain  where  it  it  pm  raw  ml,  and  |ux>(<r  corrective 
agnsb>  are  neat  to  hut  nuuaclee  which  couple  hi*  control 
outjiut*  to  Uu  s£«t  m . 

It  in  a  fart  that  the  fuactaau  of  aircraft  stabilisation  and 
control  were  eot  natural  cnpuMitie*  of  human  bran*#  ia 
the  day*  of  the  Wnght  brother*.  Thai  ntuatum  atill  nu*U, 
but,  a u  in  the  hapaaiag.  it  i*  ixaaable  with  patience  aad  (ut*  wr 
(duration  to  tram  normal  ]>erauos  ao  tint  they  can  anti Jar 
turily  iwovule  atahilwatiua  and  control  fuacUooa  under  not- 
too-revere  conditions  for  luaitad|ieriod»  of  tune. 

In  Pin.  5  tha  function  of  ymareti^  control  command 
reformation  ia  ahown  a*  being  prrformnd  by  the  guidance 
ayntern.  Thi*  system  iacluda*  four  aacticne:  1)  Tha  Deaired 
Htatr  Information  .‘Jyateu  receive*  eovironaaeatal  infoona- 
tiun  that  uUmulatea  retigi  nation  aad  daairea  and  generate* 
refrrrtu-c  inforwatioa  that  retweaentu  desired  data*  of  Um 
rfleclur  *y stare,  2)  The  Actual  SUU  Lafosmatioo  dydwa 
ntums  ronditioM  of  tha  «ff*ctur  and  tha  cDviroaroeat  and 
generate*  information  rejumanting  Uw  actual  sut*  of  the 
effector;  3)  The  Actual  Stale- 1  ha*  red  hint*  CowjMmtor 
receives  in|»at  iaforwafiua  from  item*  I  aad  9  to  genera ia 
uutjMit  information  on  tha  devlatlou  of  tha  Actual  State 
frutu  the  Dsairtd  State;  aad  4)  Tha  Command  Oeneratiag 
Uyatem  roctivee  tha  daviaiicn  infortaaihm  at  item  1  aad 
generate*  control  coanmand  kfonaaifun. 

Figure  5  judicata*  that  ia  tha  Wright  Flyer  liysieca  all  of 
the  micratiag  componania  In  tha  four  Hyetanra  liatal  i>reviouaiy 


have  their  function*  provided  by  the  human  arnar*.  nrrvre, 
aad  brain  of  tha  anna  man.  Remarkable  aa  thi*  *eci,M,  a 
relatively  abort  arhorJing  in  flying  ha*  alway*  given  normal 
being*  the  ability  to  conceive  and  plan  trip*  in  thr 
air,  to  check  on  the  progreae  of  their  flight#,  »ud  to  tair 
i Tn- awr  corrective  action#  on  tf*  ban#  of  observed  "off- 
oourae”  error*.  Then*  statement*,  of  course,  r>|>eiul  upon 
Um  availability  of  nontlnuou*  visual  ocoteclc  witli  the  earth, 
Whan  the**  contact*  are  (hut  off  for  any  reaaoo,  human  mium 
no  longer  can  |>rovidc  geometrical  reference*.  With  thrw 
goue  the  Kght  vehicle  eye ton  i*  liable  to  catastrophic  failure 
Methods  lor  eliminating  difliculUe*  of  thi*  kind  will  lie  dis- 
cunsed  later. 


GtxMsralia&d  Fuaelianel  Diagram*  for  Operating 
Sya  teats,  Susi y  n  tenu ,  and  Componenu 

Figure*  6  ami  7  repreaaat  the  functional  diagrams  for  vari¬ 
ous  subsystem*  aad  ooopooecU  of  the  over-all  generalised 
functional  diagram  of  Fig  8.  All  the  diagram*  in  thi*  srric# 
of  figure*  are  consistent  ia  ooaoepU,  in  pattern,  in  tereninologv, 
and  iu  abdication  to  th*  idea*  Maori* tad  with  Fig.  5,  which 
obviously  represent*  an  abdication  of  Fig.  8  Pi  the  nirvial 
raw  of  the  Wright  Flyer  with  a  human  pilot. 

It  i*  imjiortaat  to  note  that  all  the  statemruP*  of  the 
ixnoedre*  diwtiiiwanc  study  equally  welt  to  funcUotu  rraliaed 
ia  any  (lonaiM*  way,  whether  Usaaa  function*  are  provided 
hy  nonliving  or  by  living  eotitia*.  Thu*,  the  question  of 
aufwaafwa,  which  i*  the  replacement  of  human  funcUm*  by 
actiuo*  of  inanimate  devices,  is  not  involved  in  the  generalised 
concept*  swociatad  with  berating  system*.  Certain  giecial 
atltalsirv*  in  whkh  rom  hi  nation*  of  animate  aad  inanimate 
CMqrarnU  or  eumpkdeiy  inanimate  »ydrm*  ap|»wr  for 
various  reason*  will  b*  ooaaidcnd  later  a*  example*. 

It  ia  im^iortaat  hi  notira  that,  so  far  a*  the  over-all  fune- 
►snuUg.  at  an  operating  »y *M*n,  which  U  by  definition  an 
arvaagpwaat  tarring  a*  a  saw n«  for  th*  (wrjioroful  aeettnv- 
plidiwent  of  *o*s*  desired  result,  aad  the  function*  of  xib- 
qataei  and  coo»;x»»Mat*  art  conAsmed,  the  human-piloted 
Wright  Flight  Systran  taunt  K*v«  itvelisicd  si!  the  rewpiiil 
wuriing  ehanmt*  Mggtatnd  in  Fig.  H.  The  componaeta 
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making  up  the  airframe  effector  and  the  control  mirface 
driven  are  clearly  viable  and  identifiable.  It  ia  otherwise 
in  the  region  of  informetics,  where,  though  it  is  absolutely 
certain  that  all  functions  required  by  the  operating  chain 
must  have  been  present,  the  actual  means  were  concealed 
within  the  complex  living  structures  of  the  human  pilot  and, 
a«  such,  were  beyond  observation  as  individual  working 
components. 

Although  the  complex  of  chemical  elements  and  molecules 
which  determine  consciousness  and  activities  for  animate 
beings  has  surely  accomplished  many  wonders  during  its 
evolutionary  climb  from  the  slime  of  prehistoric  seas,  it  has 
never  in  all  of  history  and  does  not  now  completely  under¬ 
stand  its  own  functioning.  It  is,  however,  safe  to  say  that 
at  present  imagination  and  desires  can  only  be  associated 
with  human  minds.  This  means  that  the  initiating  com¬ 
ponent  in  the  desired  state  information  system  must,  in  the 
foreseeable  future,  always  be  made  up  of  men  or  be  directly 
dominated  by  men.  Out  of  imagination,  desires,  and  needs 
come  requirements,  plans,  and  programs  which  may  be 
either  generated  by  men  or  by  men  assisted  by  inanimate 
devices  such  as  computers.  Processing  of  requirements, 
plans,  and  programs  information  may  be  carried  out  by 
hitman  clerks  or  be  accomplished  by  properly  programed 
computers  to  produce  desired  state  information  in  forms 
suitable  as  reference  data  for  system  operation. 

In  order  to  make  sure  that  the  effector  of  any  operating 
system  is  giving  results  that  match  the  desired  results,  it  is 
necessary  to  determine  the  results  actually  being  achieved 
in  terms  that  may  be.directly  compared  with  corresponding 
data  that  represent  desired  results.  For  this  purpose,  the 
generalised  diagram  of  Fig.  8  shows  an  Actual  State  Informa¬ 
tion  System  that  senses  information  from  the  environment 
and  the  effector  with  respect  to  references  established  by 
instructions  from  the  Desired  State  Information  System. 
The  Actual  State  Senring  System  generally  produces  signals 
in  accordance  with  plans  and  programs  which  may  fin.t 
come  into  existence  at  distances  of  considerable  magnitude 


from  other  system  components.  For  this  reason,  provision 
must  be  made  for  transmission  o(  sensed  information  over 
distances  that  may  range  from  *ero  to  millions  of  miles. 
Witfj  communication  technology  now  well  developed  and 
signals  almost  universally  electrical  in  form,  information 
transmission  may  be  expensive,  but  is  generally  possible. 
With  sensed  data  signals  available  at  any  desired  location, 
the  next  step  is  to  process  these  signals  so  they  are  reduced 
to  forms  that  are  directly  compatible  with  derired  state 
information.  In  simple  situations  this  processing  may  be 
done  in  a  man’s  head  or  in  more  difficult  circumstances  it 
may  be  carried  out  by  complex  electronic  computers.  The 
means  used  is  not  the  essential  matter,  rather  it  is  the  fact 
that  Actual  State  Data  have  been  reduced  to  terms  in  which 
it  can  be  compared  directly  with  Derired  State  Data. 

The  Comparator,  which  carries  out  this  process,  gives 
deviation  information  as  its  output.  With  this  information 
available,  the  next  step  is  to  generate  propir  Correction 
Command  Information  to  be  supplied  as  an  essential  input 
to  the  Command  Generator.  This  component,  under  refer¬ 
ence  instructions  from  the  Desired  State  Information  System, 
produces  the  Command  Information  which  is  the  basic 
input  for  the  Control  System  to  determine  changes  in  the 
stabilisation  reference  conditions 

All  of  the  individual  functions  that  have  been  discussed, 
and  the  integrated  complex  of  functions  that  make  up  the 
Guidance  System  of  Fig.  8  which  generates  commands 
for  the  Control  System,  were  supplied  by  a  single  man  in 
the  Wright  Flyer.  Since  1903,  guidance  has  seen  so  many 
changes  that  only  a  thick  book  written  after  much  research 
could  describe  all  of  them.  There  is  no  thought  that  this 
paper  can  do  more  than  highlight  some  of  the  major  steps 
on  the  way  to  present-day  technology,  and  perhaps  to  sug¬ 
gest  something  of  the  patha  that  will  probably  be  followed  in 
the  future.  With  this  objective  in  view,  a  few  cases  from 
aeronautics,  missile  flight,  and  astronautics  will  be  cited  as 
illustrative  examples. 


2.3  STRUCTURAL  APPLICATIONS 

As  noted  in  the  introduction,  Draper* a  concept  is  univer¬ 
sal.  Therefore,  the  logic  represented  by  Figure  8  ia  directly 
applicable  to  the  structural  aysten.  Figure  9  shews  the  structural 
version  using  structurally-oriented  terns  with  the  various  portions 
of  the  system  retaining  the  same  functions  as  in  Figure  8.  It  is 
most  interesting  and  informative  to  note  how  various  practices  and 
procedures  that  have  resulted  in  successful  structural  system?  in  the 
past  are  explainable  in  terms  of  the  informetics  concepts.  likewise, 
the  new  approaches  advocated  in  various  papers  such  as  References  3 
through  15  and  others  can  be  evaluated  in  terms  of  this 
system.  This  type  of  discussion  will  be  developed  later  in  the  report . 
Before  going  into  such  detailed  discussion,  it  appears  desirable  to 
describe  the  functions  in  Figure  9  in  general  terms. 
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The  developsssnt  of  a  structural  system  and  it#  integration  with 
non-etrwoturel  *»4L4M  into  the  vehicle  eyelets  fani  thence  into  the 
total  operational  sys tea  Involves  *  series  of  Management  decisions. 
Management  actions  follow  to  implement  th#  decisions,  Information 

This  information,  when  fed  back  to  the  aansgeasr.t,  my  by  th#  basis 
for  asking  a  nw  decision  and  repeating  th#  cycle.  i&aoh  decision  is 
based  essentially  on  whether  or  not  the  system  as  it  exists  at  th# 
moment  or  a#  it  is  expected  to  be  in  the  future,  as  at  a  some  formally 
specified  or  intuitively  understood  requirement .  If  the  deoisioi  is 
yes,  th#  design*  test,  fabrication  and  operation  of  the  vehicle 
proceeds.  If  the  answer  is  no,  a  decision  is  made  on  what  sub-syatem(s) 
to  change. 

In  Draper's  terminology,  there  is  a  Desired  State  Information 
System  that  provides  a  definition  of  the  Desired  State.  There  is 
an  Actual  State  Inf creation  System  that  provides  feedback  on  the 
Actual  State  resulting  from  the  various  decisions.  Finally,  there 
is  the  Comparator  that  reveals  the  status  of  Actual  State  vis-a-vis  the 
Desired  State.  This  fores  the  basis  for  the  Management  Decision. 

As  temper  says,  "In  order  to  asks  cure  that  the  effector  of  any 
operating  system  is  giving  results  that  aatoh  the  desired  results, 

It  la  necessary  to  dstsrai ns  the  results  actually  being  achieved  in 
taraa  that  my  be  directly  compared  with  corresponding  data  that 
represent  desired  results."  In  order  to  compare  actual  with  desired 
results  the  data  oust  be  essentially  numerical  and,  thus,  object ire. 

It  Is  recognised  that  earns  decisions  arc  mads  without  the  benefit  of 
(or  even  in  spite  of)  the  appropriate  data.  This  path  ie  recognised 
by  introducing  subjective  consideration*  from  the  environ*®?. t. 

Rea sober  that  environment  is  the  total  ocmplax  of  all  the  things 
with  which  interaction*  my  occur.  By  Draper's  definition,  any 
factor  not  singled  cut  for  special  attention  remains  with  the  environ¬ 
ment  . 


It  is  usually  accepted  that  it  is  preferable  to  be  objective 
insofar  as  possible.  Decisions  mads  on  a  quantitative  basis  are 
consistent  and  repeatable.  Different  people  will  asks  the  seas 
decision,  given  the  saae  nmdiers.  Many  decision* ,  of  necessity,  are 
aade  on  a  subjective  basis  and  properly  so.  However,  it  is  a  premise  of 
tills  report  that  the  objective  decisions  baaed  on  quantitative  con¬ 
siderations  are  inherently  better  decisions. 

The  system  stats  to  which  we  are  referring  in  the  Actual  State- 
Du. tired  State  Information  System  Bay  be  one  parameter  or  it  nay  be  an 
infinity  of  parameters.  The  reglon-cf-Jnter**t  is  selected.  Thus, 

It  i*  what  we  say  it  Is.  Tht  system  state  aay  be  represent «d  by  a 
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structural  reliability  value  or  by  a  margin  of  safety.  It  may  be 
represented  by  the  probability  of  exceeding  a  specified  load  factor 
or  by  the  number  of  Unsatisfactory  Reports  (U.R.)  received  from  the 
field. 

On  the  Desired  State  side  of  the  picture,  it  should  be  noted  that 
Figure  8  shows  that  the  starting  point  is  Imagination  and  Desires. 

This  is  so  broad  that  it  encompasses  everything  from  a  precise  calcu¬ 
lation  to  a  guess,  pure  and  simple.  On  the  Actual  State  side  of  the 
picture,  the  most  important  part  of  the  Actual  State  Information 
System  (ASIS)  is  the  Effector  Actual  State  Sensor.  If  the  system  Is 
going  to  be  quantitative,  something  must  determine  the  value  of  the 
parameter  that  represents  the  state  under  consideration.  If  the 
actual  parameter  is  measurable,  the  data  processing  system  converts 
the  measured  quantity  into  the  form  needed  for  comparison.  It  is 
obvious  that  there  can  be  no  comparison  of  Actual  and  Desired  States- 
unless  there  is  a  sensor  for  the  Actual  State.  Furthermore,  a  measure¬ 
ment  of  the  Actual  State  is  not  unique.  As  in  any  sensing  and  measuring 
procedure,  the  accuracy  of  the  measurement  is  of  paramount  importance 
in  the  significance  of  the  quantity  derived  from  the  measurement. 

Tne  reader  is  more  likely  to  grasp  the  true  meaning  of 
Draper's  terms  applied  to  structural  problems  if  the  present  struc¬ 
tural  design  system,  which  is  well  known  to  all  aerospace  structures 
engineers.  Is  outlined  as  an  informatics  problem  in  considerable 
detail.  Further  understanding  can  be  gained  by  following  the  procedure 
corresponding  to  what  would  be  done  if  the  frequently  proposed  system 
of  specifying  quantitative  structural  reliability  requirements  should 
be  adopted  in  tie  future.  The  following  sections  will  discuss  these 
two  systems  as  Lnformetics  problems. 


2.U  PRESENT  (FACTOR  OF  SAFETY)  STRUCTURAL  DESIGN  SYSTEM 

The  pre3Qiit  structural  design  system  and  associated  procedures 
can  be  outlined  and  explained  very  lucidly  in  Draper's 
terms.  Rather  than  develop  the  discussion  of  the  individual  sub¬ 
systems  before  presenting  the  whole  system  as  Draper  does  in  Figures  6, 
7,  and  8,  it  appears  desirable  in  proceeding  through  the  analysis  c7 
the  structural  design  system  to  reverse  the  procedure.  There  are  so 
many  iterations  in  structural  design  that  it  will  help  to  keep  the 
function  of  each  step  in  perspective,  if  its  relationship  to  other 
steps  is  always  visible.  Accordingly,  Figure  10  is  presented  as  a 
generalized  functional  diagram  showing  how  the  present  structural 
design  system  operates. 


It  h&s  r.ot  been  clearly  understood  in  the  past  that  the  uajor 
function  of  the  structural,  design  systea  la  to  oaks  decisions. 
Structurally,  those  decision#  are  principally  o<uu*m«w  with  fcha 
question  of  whet'nar  or  not  the  structural  system  is  "strong  enough'* 
to  satisfy  the  requirements  of  the  vehicle  system.  Cbrioualy,  it  is 
MatMwj  to  sncv  what  the  r c qaxr  i ~A  z  arc  ieforo  snyof;—  ss?i  tejJL 

whether  the  requirements  arr  being  met.  This  is  the  Desired  State 
aide  of  the  system. 

In  order  to  make  the  decision,  soma  fora  of  definition  of  the 
actual  state  of  the  structural  sysiaa  oust  be  available.  Generally, 
this  definition  is  numerical  but,  unquestionably,  many  decisions  are 
mad*  on  an  intuitive  basis.  Even  these  are  likely  to  be  the  result  of 
the  decision-maker's  subconscious  estimation  and  evaluation  of  many 
parameters.  This  process  is  concerned  with  the  Actual  State  side  of 
the  system. 

As  Draper  points  out,  the  definition  of  thu  Desired  Stat#  and 
Actual  State  is  really  part  A  a  syetsa  of  collecting  and  applying 
information.  Than,  as  shown  in  Figures  8,  9,  and  10,  the  information 
is  ccapared,  decisions  are  made,  and  actions  carried  out.  There  may¬ 
be  many  iterations  of  a  particular  loop  to  arrive  at  the  desired  state 
of  a  partim  iar  parameter.  There  are  many  points  where  there  is 
feedback  o 2  information  from  one  loop  to  another  loop.  One  of  the 
benefits  cf  the  type  of  analysis  conducted  In  this  report  is  that  it 
makes  osje  organise  his  thoughts  and  develop  hie  understanding  of  why- 
various  procedures  are  followed  and  the  interrelationship  between  the 
various  steps. 

Quantitative  data  from  the  Actual  Stats  and  the  Desired  State 
Information  Systems  arj  fed  into  a  Comparator.  The  results  of  the 
comparison  become  the  basis  for  the  management  decision  to  change  the 
current  form  of  the  structural  a, -stem  or  to  make  no  change.  It  shculd 
be  noted  that  management  decision  in  the  conteoct  of  this  discussion 
does  not  refer  to  any  single  individual  or  organisation.  The  manage¬ 
ment  asking  a  particular  decision  varies  from  time  to  time,  depending 
on  the  question  to  be  decided.  Sometitasc  the  sumagement  involved  is 
in  tlve  contractor's  organ  tiomj  s centimes  in  the  custoorr ' a. 

Sometime*  the  decision  is  wade  by  an  analyst  signing-off  a  drawing; 
aottsstimea  the  decision  is  mede  at  the  highest  executive  levels.  The 
source  of  the  Management  de«laion  will  be  discussed  at  greater  length 
during  ths  detailed  discussions.  However  made,  the  Management  decisions 
axe  Implemented  by  management  actions  affecting  the  various  stages  in 
the  design  and  operation  of  the  vehiria  system. 


T 


t,  D? aired  State  Information  System  (DSIS) 

The  prrxseas  ox  defining  the  require*  mt  a  for  the  structural 
system  involves  the  Desired  State  Information  System.  This  system 
la  tutMu  ee  pert  of  Figure  10  and  separately  In  Figure  11.  The 
Desired  State  of  the  structural  system  originates  in  the  concept  that 
the  operational  aystma  should  have  s  characteristic  vaguely  character* 
Ihu  m  struct ural  integrity.  The  tera  structural  integrity  means 
different  things  to  different  people.  There  has  never  been  a  quanti¬ 
tative  definition  established  that  would  satisfy  all  concerned. 

There  are  sow  who  say  that  the  goal  is  no  structural  failures.  They 
sill  not  adsdt  that  anything  lass  than  perfection  is  acceptable.  In 
this  case,  actions  speak  louder  than  words.  If  no  failures  were  the 
goal,  the  factor  of  safety  would  be  increased  to  2.0  or  5.0  or  10.0. 

Such  an  action  would  certainly  bring  the  failure  rates  of  aerospace 
structural  systems  cloasr  to  ser<>  than  they  now  are. 

Therefore,  it  1#  postulate!  that  a  "no  failure11  Desired  State  is 
not  the  true  reflection  of  what  hae  bean  acceptable  in  the  peat.  It 
is  generally  accepted  that  tha  structural  system  is  not  required  to 
survive  in  the  face  of  all  possible  errors  in  fabrication,  maintenance 
and  operation  of  the  syetssL.  A  sore  tenable  position  is  that  the 
structure!  systems  of  the  past  have  been  aspect sd  to  have  e  reasonably 
low  failure  rate,  Houever,  a  precise  definition  of  what  la  meant  by 
"reasonably  low"  has  not  been  spelled  out.  In  affect,  the  definition 
was  reviewed  and  reestablished  on  an  ad  hoc  basis  every  time  e  failure 
occurred.  Whenever  «  failure  occurred,  someone  decided  the  "cause. " 
Then,  if  the  cause  was  structural,  a  decision  was  Bade  either  explicitly 
or  ijqxLioitly  on  whether  this  failure  (possibly  in  conjunction  with 
others  of  e  similar  nature)  represented  "too  many"  failures.  If  it 
did,  this  became  the  basis  for  revising  the  struotvral  design  criteria. 
As  shown  on  Figures  10  and  11,  a  management  decision  of  this  type, 
converted  into  the  management  action  of  Issuing  a  new  version  of  the 
criteria,  is  the  sole  basis  for  the  generalised  structural  design 
criteria  (SDC),  In  this  discussion,  generalised  structural  design 
criteria  means  a  specification  issued  by  some  agency,  usually  govern¬ 
mental,  such  as  KIL-A-38S0  and  FAB  25 •  Thera  is  no  corresponding 
document  for  space  vehicle*  at  the  present  time. 

A  vehicle  structural  design  criteria  document  is  produced,  baaed 
on  the  generalised  SDC.  This  SDC  defines  the  requirements  for  the 
particular  vehicle  system.  Certain  specific  quantities,  such  as  load 
factors,  velocities,  trajectories,  etc.,  may  be  specified  in  the  model 
specification.  Sometime*  tha  model  specification  will  override  the 
generalised  3DC  and  explicitly  fcneilate  now  requirements. 
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Fran  the  vehicle  SDC,  thr  Hail  ugd^ii  conditions  are  generated. 

It  is  an  important  consideration  that  thasa  Halt  design  conditions 
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Stats.  The  l  =•■  t  conditions  arc  calculated  as  a  step  in  the  strength 
analysis  procedure  which  is  part  of  the  ASI5  (to  be  described  later). 

Thus,  any  error  la  ccnsdssian  or  ssdesian  in  tho  ASI3  analysis  will 
be  fed  into  the  D&1S.  In  such  cases,  the  structural  system  say  have 
the  desired  poaiuivs  M.3.,  but  for  the  wrong  conditions,  so  the 
vehicle  vizi  fa? 1  xn  opera wicn. 

In  the  design  analysis,  Halt  loads  are  calculated  for  the  Halt 
conditions.  Those  loads  are  fi'iltiplled  by  the  specified  factor  of 
safety  to  obtain  ultlaate  loads.  This  operation  also  is  performed 
as  part  of  tho  ASXS,  but  the  results  are  used  to  define  the  Desired 
State.  As  was  the  case  for  the  llait  design  conditions,  the  design 
ultlaate  loads  are  subject  to  error  which  aaans  the  definition  of  the 
Desired  State  loads  is  in  error  by  exactly  the  sane  amount  as  the 
Acturl  State  leads.  Again  a  ,.ositivs  margin  may  be  shown  but  the 
failure  rate  will  be  far  too  high. 

The  last  step  in  the  procedure  is  that  the  Desired  State  is 
quantitlsod  as  a  state  of  the  structural  ay at so  where  there  is  a 
positive  margin  of  safety  (H.S.)  for  all  design  ultlaate  loads. 

Summarising  what  was  described  above  and  shown  on  Figure  11,  the 
Desired  State  Information  System  produces  four  separate  numbers 
quant  it  i  sing  the  Desired  State  of  the  structural  system.  The  first 
is  that  there  be  a  reasonably  low  total  failure  rats.  This  number 
is  not  really  defined  but  each  failure  is  reviewed  and  the  decision 
made  whether  or  not  to  change  the  structural,  design  criteria.  This 
is  an  indirect  manifestation  of  whether  the  failure  rate  is  “too  high" 
without  tho  necessity  of  defining  the  discrete  muter  where  it  becomes 
"too  high." 

The  second  Desired  State  quantity  is  a  aero  failure  rata  at 
limit  condition  or  lees.  This  is  certainly  a  definable  quantity. 

The  occurrence  of  such  a  failure  is  almost  automatically  taken  as  an  in¬ 
dication  that  there  is  a  gross  error*  somewhere  in  the  design  or  fabrica¬ 
tion  of  the  structural  system.  There  should  be  no  failure  at  Halt 
conditions  or  less  since,  by  definition,  limit  conditions  are  permissible 
or  safe. 

Hie  third  Desired  State  quantity  is  the  one  that  controls  moat 
of  the  structural  design.  This  quantity  is  the  margin  of  safety.  If 
the  calculated  margin  of  safety  is  negative,  the  design  is  modified 
until  a  positive  margin  is  shown.  If  the  test  strength  is  lower  than 
the  analytical  strength,  the  analysis  is  usually  changed  to  conform  to 
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tin*  t««t  results  and  ii  the  K.5.  becomes  naeativw  the  design  la  modified. 
If  s  flight  loads  prograu  rrreale  that  the  loads  ar*^  higher  thsn 
predicted  resulting  in  *  negative  “rgin,  the  situats-ss?  i? 
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rsdsfii suing  the  struct urs. 


ill  etruitur&l  dewlslccts  b&£«  Airing  th*  early  ptmaa 
of  th*  vehicle  design  ere  mad*  an  the  basis  of  the  Hgniturie  of  the 
margin  of  eafety ,  The  other  three  quantities  only  become  meaningful 
ATvwr  prvdvHiiivn  ▼witiei.ee  !»▼%  gone  into  vyerwwiwi.  Thu*,  vl»w  evn- 
eequenoee  of  any  changes  required  after  operationn  begin  *re  euoh 
•ore  draetio  than  whan  they  result  from  e  negative  K3  determined 
during  design  analysis  or  during  testing*  As  Coutinhoi®  points  out, 

"The  earlier  in  the  design  cycle  that  the  Information  becomes  available. 


the  acre  useful  it  will  be.” 


The  fourth  Desired  State  quantity  is  a  minimum  cost  in  terse  of 
either  weight  or  dollars.  If  weight  were  not  e  consideration  in  the  F.S., 
the  desired  values  for  the  other  three  quantities  would  be  ouch  larger. 

The  seas  is  true  for  the  dollar  coat.  Although  there  is  no  procedure  for 
— fc-twg  trade-offs  between  cost  end  failure  rate  in  establishing  structural 
design  criteria,  a  reasonable  balance  ie  attained  by  the  necessity  to  be 
"practical"  when  considering  changes  to  the  criteria.  Cos'':  and  weight 
considerations  are  beyond  the  scope  of  the  present  study  end  are  not 
considered  further. 

b.  Actual  State  Inf or eat ion  System  (ASIS) 

The  function  of  the  Actual  State  Information  System  is  to  determine 
as  accurately  as  possible  the  actual  aagnitude  of  the  parameters  for 
which  a  desired  value  was  eetablishsd  In  the  Desired  State  Information 
System.  In  the  analogy  of  the  flight  systems  described  by  Draper, 
the  process  starts  with  a  sensor  that  measures  some  paraswter.  It  is  a 
wall-known  engineering  fact  that  some  Instruments  are  rcoro  accurate 
than  others.  The  sensors  in  the  structural  design  systw,  have  not 
always  been  recognised  as  performing  a  seising  function,  rfith  a  little 
thought  the  sensor  can  be  identified  in  each  specific  situation.  Some¬ 
times  the  sensor  is  a  sathsmatioal  calculation,  sometimes  it  is  the 
act  of  a  structure  failing  or  surviving.  If  no  sensor  can  be  identified, 
it  is  a  strong  indication  that  the  procedures  being  followed  arc  not 
very  purposeful.  After  all,  the  function  of  any  operating  system  is 
to  serve  "as  a  means  for  the  purposeful  accomplishment  of  tome  d*  aired 
result."2 

In  the  ASIS  outlined  cn  Figure  10,  there  are  five  different 
sections  end  there  a ay  be  others.  Each  section  corresponds  to  a 
different  stage  In  the  design  and  operation  of  tbs  particular  vehicle 
system.  Continuing  the  analogy  to  Draper's  flight  control  systems, 
each  section  of  the  ASIS  on  Figure  ID  corresponds  to  a  dsmouremmit 
with  a  different  type  of  lnstruamnt  which  is  progressively  more  accurst*. 
Each  cf  th*  five  sections  will  be  described  separately  in  th*  otder  that 
they  would  normally  occur  in  th*  structural  design  proceas. 
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(1)  Analytical  Design  Stage 


The  first  prediction  of  the  actual  state  of  the  M.S.  of  the 
structural  system  results  from  the  analyses  conducted  during  the 
design  stage  of  the  vehicle  system.  The  M.S.  calculation  is  the 
end  result  of  the  strength  analysis.  It  should  be  noted  that  this 
calculation  was  deliberately  labeled  a  prediction.  A  prediction  and 
a  determination  are  not  the  same  thing,  although  Coutinho  points  out 
in  Reference  16  that,  "In  the  eyes  of  the  analyst,  'to  predict' 
generally  means  'to  determine. '" 

The  analysis  begins,  as  shown  in  Figure  12,  with  the  calculation 
of  limit  design  conditions.  These  limit  conditions  are  based  on  the 
requirements  set  forth  in  the  vehicle  structural  design  criteria.  A 
loads  analysis  follows  to  obtain  loads  at  various  locations  on  the 
vehicle  for  each  of  the  limit  design  conditions.  Wind  tunnel  tests 
may  be  conducted  to  assist  in  the  analysis.  However,  wind  tunnel  tests 
are  not  considered  a  substitute  for  full -scale  flight  tests  in  the 
verification  of  the  design  loads. 

The  strength  analysis  follows  next  using  the  loads  for  the 
specified  operational  conditions.  Component  strength  tests  may  aid 
the  analysis  at  this  point.  Fran  the  strength  analysis  comes  a 
prediction  of  whether  the  structure,  as  defined  by  the  current  drawings 
and  specifications,  will  support  the  design  load*.  The  strength 
analysis  report  results  In  a  summary  of  the  calculated  margin  of  safety 
for  various  critical  elements  of  the  structure. 

This  calculated  M.S.  is  the  "indicator"  of  the  Actual  State.  It 
is  the  quantitative  parameter  that  is  compared  to  the  desired  value. 

If  the  M.S.  is  zero  or  greater,  the  design  couplies  with  the  specifi¬ 
cation  requirements.  Cbviouoly,  the  contractor's  management  can  decide 
that  some  more  conservative  value  is  required  for  other  purposes.  If 
the  M.S.  is  negative,  the  decision  presumably  is  to  change  the  design 
to  increase  the  strength  or  tc  change  the  operation  to  decrease  the 
load.  This  results  in  modified  drawings  and  the  process  is  repeated. 

The  procedure  is  presented  as  though  it  is  a  simple,  direct 
process;  but  any  experienced  structural  engineer  knows  that  the  process 
is  anything  but  simple  and  direct.  Starting  with  the  preliminary 
design  of  the  vehicle,  there  are  many  iterations  of  the  analyses  out¬ 
lined  on  Figure  12.  Often  the  loads  or  strength  analyses  are  changed 
before  the  strength  analysis  is  completed,  so  there  are  many  partial 
Iterations.  The  nunfoar  of  iterations  and  when  they  occur  does  not 
affect  the  basic  functional  purpose  of  each  segment  of  the  Actual  State 
Information  System  shown  on  Figure  12. 

The  only  difficulty  in  using  this  Analytical  Design  Stage  of  the 
ASIS  is  that  it  is  somewhat  less  accurate  than  needed  to  assure  the 
low  failure  rates  and  high  structural  integrity  usually  established  by 
the  DSIS  of  Figure  11.  This  is  analogous  to  an  instrument  that  measures 
velocity  but  does  it  somewhat  crudely.  A  number  can  be  read  from  the 
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instrument  at  any  time  but  a  large  plus  and  minus  value  must  be  attached  to 
the  reading  to  make  it  meaningful.  Reference  17  documents  the  fact  that  13 
percent  of  the  aircraft  wings  tested  for  the  Air  Force  during  the  1940 
decade  failed  at  less  than  two-thirds  of  the  intended  value.  One  percent 
failed  at  lees  than  one-third  of  the  intended  value.  Also,  there  are  many 
known  instances  of  errors  in  the  loads  analysis.  There  is  no  indication  that 
the  situation  has  improved  for  the  present  generation  of  aircraft  and  space 
vehicles.  It  is  generally  accepted  that  testing  is  a  necessary  part  of  the 
structural  design  system.  The  testing  segments  of  the  ASIS  will  be  described 
in  the  following  sections. 

(2)  Strength  Test  Stage 

The  couplet e  functional  diagram  presented  in  Figure  10  shows  three 
branches  of  the  ASIS  that  involve  testing  to  furnish  information  Improving 
the  prediction  of  the  M.S.  The  first  of  these  is  the  Strength  Test  Stage 
shown  in  Figure  13.  The  previous  section  notsd  that  the  Analytical  Design 
Stage  was  an  imperfect  tool  for  measuring  M.S.  The  strength  test  typically 
involves  a  static  test  but  certainly  does  not  exclude  dynamic  and  fatigue 
teats.  This  improves  the  oituation  by  disclosing, through  premature  failure 
during  the  test,  errors  in  the  strength  analysis.  The  beauty  of  the  procedure 
is  that  even  one  teat  can  disclose  that  it  is  likely  that  there  is  an  error 
in  the  design  causing  the  premature  failure.  The  failure  does  not  prove 
that  there  is  an  error.  After  all,  it  is  conceivable  that  a  structural 
strength,  corresponding  to  a  value  so  low  it  would  occur  only  once  in  a 
thousand  or.  once  in  a  million  structures,  might  have  been  present  in  the 
particular  structure  fabricated  for  the  test.  This  could  occur  with  the 
wean  strength  and  99-percent  exceed  strength  exactly  where  they  were  predicted 
to  be.  However,  a  decision  can  always  be  made  that  any  structure  failing 
below  the  design  load  is  deficient.  Ch  rare  occasions,  the  decision  will  be 
wrong  and  a  structural  system  that  is  already  reliable  enough  will  be 
unnecessarily  redesijned  for  greater  strength.  On  the  other  hand,  it  might 
take  hundreds  or  even  millions  of  tests  to  prove  statistically  that  the 
reliability  is  as  high  as  desired.  (See  discussion  on  pages  101  and  109). 

The  Strength  Test  Stage  of  the  ASIS  begins  with  the  selection  of  a 
static  test  article.  It  is  presumably  a  representative  specimen  of  the 
structural  system  defined  by  the  same  drawings  and  specifications  used  in 
the  loads  and  stress  analyses.  The  necessary  instrumentation  is  added.  The 
test  loads  are  essentially  a3  derived  in  the  loads  analysis.  The  results  of 
the  static  test  such  as  the  stresses  and  deflection  associated  with  particular 
loads,  together  with  the  fact  of  yield  or  rupture,  fond  back  to  the  strength 
analysis.  If  there  are  any  serious  discrepancies  between  the  analysis  and 
the  experimental  data,  the  analysis  usually  is  revised  and  another  iteration 
of  the  Analytical  Design  Stage  follows. 

f 

The  basic  instrument  that  functions  as  the  "indicator"  In  the  Strength 
Test  Stage  ASIS  is  the  strength  test  report.  Effectively,  the  report 
establishes  a  new  M.S.  Obviously,  if  the  structure  failed  prematurely, 
the  M.S.  is  negative.  A  management  decision  must  follow  on  what  action 
should  be  followed  to  eliminate  the  negative  M.S. 


-  21  - 


Stftty  for  D«ai«n 


er  3Hnoii 


(3)  Flight  Teat  Stage 


The  second  of  the  three  teat  branches  of  the  ASIS  is  the  Flight 
Test  Stage,  shown  in  Figure  14.  This  performs  the  function  of 
disclosing  error  in  the  loads  analysis  as  the  static  teat  does  for 
the  strength  analysis.  The  Flight  Test  Stage  of  the  ASIS  begins  with 
the  selection  of  a  flight  test  article.  It  is  presumably  a  represen¬ 
tative  specimen  of  the  vehicle  including  the  structural  system  and 
a1 1  other  systems  that  affect  the  structural  system.  Instrumentation 
is  added  to  measure  the  loads  at  selected  locations  on  the  vehicle. 

During  the  program,  loads  are  measured  for  various  flight  conditions, 
providing  information  for  correlation  with  the  loads  analysis.  If  the 
loads  are  different  than  predicted  in  the  loads  analysis,  this  results 
in  revision  of  the  loads  analysis,  the  strength  analysis  and  then  the 
K.S.  If  the  revision  results  in  a  negative  M.S.,  design  modification 
and  additional  static  testing  may  be  necessary  and  the  cycle  is  repeated. 

Many  Flight  Test  Stages  include  Structural  Demonstration  Flights  as 
indicated  on  Figure  14.  If  the  structural  demonstration  is  conducted  on 
the  same  vehicle  as  the  flight  loads  measurements,  the  demonstration  will 
represent  the  extreme  condition  at  which  loads  are  obtained.  In  addition, 
the  demonstration  integrates  all  of  the  strength  and  load  considerations 
into  a  single  proof  that  the  vehicle  can  actually  survive  the  limit 
conditions.  It  occasionally  discloses  that  the  strength  test  did  not 
truly  simulate  the  flight  condition. 

Generally,  the  suc-esafuly  conclusion  of  the  flight  loads  test 
program  and  the  structural  demonstration  flights  signals  the  completion 
of  the  design  qualification  of  the  structural  system.  In  aircraft,  the 
interim  restrictions  are  removed  and  the  user  is  free  to  operate  the 
vehicle  to  the  limits  specified  in  the  vehicle  structural  design  criteria. 
In  space  vehicles,  where  testing  and  operations  tend  to  coincide,  tne 
vehicle  system  is  cleared  for  extended  operations  including  manned 
flights. 


(4)  Proof  Test  Stage 

The  third  and  last  of  the  testing  stages  of  the  ASIS  is  the  proof 
tast  3hown  in  Figure  15.  Thi3  stage  is  not  an  integral  part  of  every 
vehicle  system.  However,  it  has  been  found  desirable  or  necessary  to 
conduct  proof  tests  on  many  vehicles  before  accepting  the  individual 
vehicle  for  service.  There  are  many  reasons  for  such  a  situation,  but 
they  all  are  based  on  a  single  fundamental  problem.  If  there  is  a 
significant  possibility  that  the  individual  structure  will  be  grossly 
understrength  relative  to  the  intended  strength  even  though  the  average 
strength  is  satisfactory,  a  proof  (or  acceptance)  test  may  be  the 
answer.  Typical  situations  where  proof  testing  is  a  desirable  and 
necessary  tool  occur  with  welded  pressure  vessels,  some  types  of  bonded 
strictures,  and  primary  control  surfaces  of  aircraft. 

Proof  testing  is  comparable  to  the  process  described  under  the 
Strength  Tost  Stage.  The  basic  difference  is  that  each  and  every 
vehicle  is  subjected  to  the  test  rather  than  one  typical  system  and 
the-  number  of  .conditions  tested  is  usually  much  reduced.  Usually, 
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feta  proof  teat  im  oo»*tuct#d  to  «  load  eosewfcat  over  limit  but  consider¬ 
ably  under  ultimate.  A  sort  philoeophlo  dletinati on  io  that  tha  proof 
T.««t  la  QQ&mnm  with  tha  M.S.  of  tha  iadlTida&l  srtiel*  whereas 
tha  static  taav  ia  vncmni  vita  too  H.5.  of  tb*  system  ooapn*lrg 
mnj  articles.  Tha  failure  during  proof  t«t  at  l omt ically 
the  underalre esgia  artiei*  so  no  nanagaawnt  action  la  raaily  naooeeary, 
Howsvar,  xa  ah  own  on  Figure  15,  tha  formal  reeultajut  of  tha  teet 
failure  la  tha  dlaoloanra  that  tha  MLS,  for  that  particular  artist* 
was  Isas  than  aero, 

(5)  Op# rational  Failure  Stag* 

Tb*  prorloua  aogaanta  of  tha  ASI3  haw  t**n  ooooarnad  with 
"measuring"  tha  MLS.  bafora  tha  vahlala  b«coii  operational.  Tha 
Operational  Pallors  Stags  of  tha  A3I3,  shewn  on  Flgurs  16,  Is  conosrnsd 
with  tbs  uaa  of  information  that  becomes  available  during  operational 
ttaags  of  tha  vehicle  eyetesi.  Any  fallura  of  any  atructural  a  capon  ant 
is  usually  investigated  to  determine  tha  "oauee"  of  tha  fallura.  This 
investigation  is  a  final  source  of  information  on  tha  Actual  Stats  of 
tha  structural  system.  It  should  ba  noted  that  this  segment  of  the 
ASX3  la  the  only  one  not  completely  concerned  with  M.S.  It  should 
also  be  noted  that  tha  failure  rats,  even  at  the  and  of  the  service 
life  of  each  vehicle  in  the  system,  is  not  directly  convertible  into 
a  probability  of  failure  or  a  structural  reliability  figure.  This 
is  the  same  kind  of  statsmmit  as  saying  that  obtaining  7  cut  of  10 
heads  la  the  toss  of  a  coin  does  not  correspond  to  a  probability  of 
0.7.  The  probability  of  heads  remains  at  0.5.  The  rate  of  occurrence 
of  an  evant  la  only  an  approximation  of  the  probability  of  oeourrenoe. 
When  the  number  of  event  a  is  small,  as  in  the  case  of  atructural 
failures,  ths  correlation  between  failure  rat*  and  probability  of 
failure  my  be  very  poor.  As  a  result,  the  information  on  structural 
failures  is  usually  nor*  useful  in  the  determination  of  causa  of  failure 
and  corrective  action  to  prevent  reoccurrence  of  ths  fallura  than  in 
establishing  reliability  levels. 

Procedures  represented  by  the  *J?IS  shown  on  Figure  It  are  well 
known  but  a  brief  discussion  of  each  of  the  functional  blocks  is 
warranted.  As  operations  proceed,  structural  failures  occasionally 
happen.  When  one  does  occur,  it  is  initially  classified  as  major  or 
minor.  Minor  failure*  are  typically  yield  failures  that  are  repairable, 
crack*  that  are  not  catastrophic  and  sir-ll.,r  occurrence ,,  Major 
failures  typically  Involve  rupture  of  th-'  c:  ^pcnuit  reacting  in  loss 
of  the  vehicle  and  injuries  to  the  crew,  Kjwever,  it  is  not  intended 
that  the  definitions  above  bs  anything  mors  than  a  guide  to  the  meaning 
of  major  end  minor  failure*  as  the  terms  are  used  in  this  discussion. 

If  the  failure  is  minor,  an  Unsatisfactory  Sepcrt  (or  it* 
equivalent)  is  subidtted  to  tb*  contractor  for  investigation  and 
corrective  action.  If  ths  failure  is  major,  an  ad-hoc  group,  composed 


of  contractor  and  customer  rapraseutabivse  is  asseal&lod  to  investigate 
sr si  deisrsino  tbs  c suss,  One  cf  ths  da&osrsLn&tioas  ©f  the  appropriate 
imvsatig&t lag  grou.jp  it*  whether  or  not  the  failure  was  the  result  of 
structural  causes.  If  tha  decision  la  non- structural,  auoh  a  decision 
is  s^fsiiraisct  to  dsoidiss  that  tho  H.S.  is  positive  and  that  ths 
structure  was  overloaded.  Corrective  action  la  outside  tha  structural 
araa.  The  nmrisar  of  oocurrancaa  my  bs  coopered  against  tha  vaguely 
daflnad  Desired  State  condition  of  “Reasonably  Low  Total  Failure  Rate" 
shown  on  Figure  11.  It  nay  ba  decided  at  any  tins  in  the  "Management 
Decision"  block  that  "too  aery"  failures  are  occurring  due  to  overloading. 
Further,  it  aay  be  decided  that  the  situation  cannot  be  controlled  by 
modifying  ths  operational  prooeduree.  la  this  situation  it  aay  be 
decided  that  the  structure  aust  accommodate  the  aore  severe  environaont. 
In  such  a  ease,  what  was  foraarly  considered  to  be  an  overload  oust 
new  be  considered  a  design  condition.  The  structural  design  criteria 
is  aodified  accordingly. 

If  the  decision  on  the  failure  cause  is  that  the  structure  is 
understrength,  the  K.S.  is  necessarily  negative*  If  it  failed  at 
Halt  conditions  or  lsss,  the  structure  aust  be  grossly  understrength 
and  the  responsibility  almost  necessarily  falls  in  the  irnufacturlng 
or  aaintananoe  areas.  Occasionally  the  understrength  is  not  attribut¬ 
able  to  a  defect  in  the  individual  article  but  to  a  basic  error  in  the 
design.  This  asans  that  the  analytical  and  testing  stages  of  the 
ASIS  (Figures  12  to  14)  were  not  sufficiently  accurate  disclosers  of 
the  design  error.  Typically  the  error  in  testing  steamed  from  over- 
loaidng  the  condition  completely  or  froa  a  poor  simulation  of  1. '  .t. 
actual  operational  conditions  during  the  teat.  tbe  raa*c*iing 
pertains  to  failures  beyond  Halt  conditions  but  at  a  condition  that 
represented  a  negative  margin. 

c.  Other  System  Functions 

The  Desired  State  Information  System  and  Actual  State  Information 
System  are  the  key  elements  in  any  operational  system.  The  sans  Is 
true  in  a  structural  design  system.  The  DSIS  and  ASIS  furnish  the 
information  used  in  asking  the  decisions  but  many  other  functions 
contribute  to  the  final  result.  These  other  functions  are  described 
in  this  section  and  shewn  on  Figure  10. 

The  Coaqperator  furnishes  the  miaarlcal  value  of  the  dii.'arence 
between  the  desired  state  value  of  a  parameter  and  the  actual  state 
value.  In  structural  design  this  function  is  not  usually  formalised. 
Typically,  the  strength  analysis  report  has  a  section  listing  the 
lowest  values  of  the  margin  of  safety.  Each  listed  value  of  the  M.S. 
is  an  output  of  ths  ASIS  to  the  Comparator.  Since  the  Desired  3tate 
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th«  input,  For  this  reason,  thsrs  tanas  to  bs  seas  blarrlag  of  U»e 
difference  between  the  two  functions  «o  that  it  is  not  reedily 
apparent  to  ail  concerned  that  there  arc  two  separate  fWmi.lons. 

Occasionally,  something  breaks  down  in  t  re  ns  sitting  the  infor- 

t  czi  H .a.  to  oho  proper  ssaagasant.  mini  this  iwppons  a  deferred 
discovery  of  a  negative  H.S.  my  occur  with  its  attendant  increase  in 
difficulty  of  correcting  tha  situation.  In  any  design  system,  the 
procedure  for  quantifying  the  difference  between  the  Desired  and 
Actual  States  must  be  clear-cut  or  the  decisions  nay  not  be  properly 
objective. 

The  Mknageasnt  Decision  function  in  the  Present  System  corresponds 
to  the  Control  Cooeand  Generator  in  Diaper's  analysis  as  shown  on 
Figure  8.  In  the  Present  Structural  Design  System,  it  represmita 
the  decisions  at  many  different  levels.  Ho  attm**  is  mde  in  this 
report  to  outline  all  the  decision  apparatus.  It  Includes  both 

contractor  and  customer  personnel.  As  an  example,  a  stress  analyst 
in  the  contractor's  organisation  night  decide  that  a  particular 
had  a  negative  margin  and  the  designer  night  concur,  — n„e  the  change 
immediately.  Ho  higher  authority  might  be  involved.  Eventually, 
all  of  the  loads  and  strangth  analyses  mist  be  approved  by  the  top 
nsnagamwit  the  contractor  organisation.  Than,  the  reports  are 
submitted  to  the  customer  organisation  for  approval.  Thus,  the  rwi 
management  decision  involves  approval  of  previous  decisions  arv*  naxy 
iterations  of  these  dacdsions  all  along  the  line. 

Management  declaims  are  translated  into  action  that  takes  mit»t 
forms.  Management  action  leads  to  cutting  metal  in  fabricating  a 
teat  structure.  It  also  leads  to  revisions  in  the  structural  design 
criteria.  Or  it  may  lead  to  a  release  of  a  daaign  for  production*  A1 1 
elements  In  the  design,  fabrication  and  operation  of  a  vehicle  system 
are  the  result  of  a  management  action  regardless  of  who  actually  per¬ 
forms  the  action.  These  management  actions  are  equivalent  to  pulling 
on  the  a  antral  stick  in  Figure  5}  such  things  as  specifications, 
drawings  and  handbooks  are  part  of  the  System  Control.  These  are  the 
■eane  whereby  tha  management  decisions  are  translated  into  the  desired 
inieraotia;  between  the  Effector  and  the  environment. 

The  Effector  in  the  Structural  Design  System  is  the  hardware 
corresponding  to  the  structural  system.  There  are  many  steps,  between 
managsmnt  action  and  tha  hardware,  that  are  not  explicitly  shown. 

These  include  materials  producers,  manufacturing  cyst  mm,  quality 
control,  and  subcontractor  relationship*.  These  all  contribute  to 
the  Actual  State  of  the  structural  system  and  mist  be  considered  in  a 
complete  analysis.  Also,  any  failure  in  the  structure  may  be  traced 
to  one  of  these  subsystems  and  the  management  decision  my  bring  about 
corrective  action  at  the  appropriate  level. 
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Konfsirocitual  nyst *oa  are  cooblned  with  the  atructural  system 
to  aahlfflro  a  vehicle  system.  Haro  again,  there  ara  Mipr  interface* 
with  thit  structural  system,  Far  instance,  m  act '■-at  or  produces  i 
fares  that  ths  structural  system  wot  withstand,  Lee*  obvious  are 
rsqjulra— ate  that  tha  atructural  system  mat  tolerate  mal  ^motions 
ir  nt'hy*  aystsass*  t—  si-.L-i”  fg--«  -f  structural  fal lars  of  this  typs, 
tha  decision  on  corrective  action  nay  be  an  arbitrary  management 
decision.  It  aay  be  dooidad  that  tha  failure  in  tha  othar  system 
that  caused  tha  atruotural  failure  must  ba  corrected  and  tha  atructural 
ay stem  retains  unchanged.  Ch  tha  othar  hand,  thara  hara  been  aany 
daeiaicna  that  failuraa  in  othar  systems  became  part  of  tha  environment 
that  tha  structural  system  auat  withstand.  Such  daciaiona  usually 
raault  fram  problems  in  asking  the  othar  ayataa  rallabla  enough  without 
excessive  ocat,  weight,  or  devmlopaact  time. 


Tha  Tahiola  ayataa  together  with  ita  ground  support  aqulpoant 
constitutes  tha  operating  ayataa,  What  aLght  ba  call  ad  software  could 
ba  lnolnded  in  tha  operational  ayataa.  Software  alght  include  pilot's 
handbooks,  launch  limitations,  flight  plana,  and  similar  itaaa. 

These  all  hare  inter faces  with  tha  structural  ayataa  and  decisions 
mat  ba  made  on  tha  division  of  responsibility  between  tha  various 
systems.  Roughly  hoisting  tha  oapeule  of  a  apace  vehicle  might  result 
in  failure  at  tha  hoisting  lugs.  Corrective  action  could  require 
stronger  lugs  or  tha  action  eight  be  to  revamp  the  hoisting  procedure 
to  ell aft  rate  any  sudden  hoisting  movements,  thus  controlling  tha  magni¬ 
tude  of  the  hoisting  loads. 

toother  anuq&a  of  software  is  tha  prevision  of  weather  information 
affecting  the  vehicle  operation.  In  space  vehicle  launches,  a  careful 
prediction  of  the  winds  aloft  is  made  bafora  each  launch  and  ground 
rules  are  established  to  hold  a  launch  when  excessive  winds  are 
expected,  filler  actions  ore  taken  in  aircraft  operation  to  predict 
areas  of  high  turbulence  and  to  vector  the  aircraft  around  stormy 
areas  whenever  possible, 

Beuh  of  thee#  systems  has  an  interface  with  the  structural  system 
and  decisions  are  needed  on  where  the  line  of  demarcation  lies. 
Obviously,  a  decision  can  always  bs  reversed  and  new  requirements 
Imposed  on  the  structural  system.  There  is  no  hard  and  fast  rule  on 
how  to  make  these  daciaiona .  Whatever  the  decision,  it  should  always 
be  an  explicit  decision  and  the  decision  should  be  oowmunioated  to 
those  responsible  for  managing  the  mystme  in  question.  If  this  is 
not  dope  properly  (lack  of  proper  communication  has  bean  a  problem 
in  the  past),  the  opportunities  ft  structural  failure  will  multiply 
unnecessarily. 
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2.5  rjTxZU  STATISTICAL  SThUbTUKAJL  KbLIABILITT  3TSTEM5 

The  Introduction  of  a  structural  design  system,  with  a  purely 
atStletloal  *triiisiursl  reliability  basis  ,  has  bean  proposed  by  aefijr 
authors. 3 5,9,10,11,12,13 The  concept  is  very  attractive. 

For  one  thing,  It  quant itise#  th#  design  requirements  in  *  rational 
fashion.  If  tha  reliability  of  the  structural  syattts  Oio  b«  eeuer- 
tained,  it  can  ba  incorporated  with  th#  reliabilities  of  non- structural 
systems  to  obtain  an  overall  reliability  for  the  total  vehicle  system. 

This  seemingly  attractive  concept  has  nevar  baen  accepted  by  the 
aerospace  industry  for  general  use  in  the  design  of  structural  systems. 
An  examination  of  tha  purely  statistical  structural  reliability 
procedure  from  the  informatics  viewpoint  discloses  some  of  the  reasons 
for  this  lack  of  acceptance. 

a.  Desired  State  Iaformtion  System 

The  definition  of  the  Desired  State  for  this  type  of  structural 
system  is  sljqpliclty  itself.  It  is  shown  in  Figure  17.  Management 
action  can  establish  a  desired  structural  reliability  for  various 
classes  of  vehicles  in  the  generalised  SDC.  The  model  specification 
can  establish  a  classification  appropriate  to  the  mission  requirements 
for  that  particular  model.  This  quantitites  the  etruotural  reliability 
requireswnt  for  the  vehicle  ayetea  til  question.  As  an  alternate,  the 
desired  reliability  for  the  complete  vehicle  can  be  established.  The 
required  structural  reliability  can  be  alloaated  to  be  consistent 
with  the  other  clement ■  of  the  vehicle  system.  Either  way  a  single 
number,  such  as  0.99999,  can  represent  the  Desired  State  of  the 
structural  system  This  number  oan  be  further  subdivided  to  allocate 
a  structural  reliability  or  probability  of  failure  to  eaoh  cosqwnent 
In  the  structural  system. 

br,  Actual  Stew  Inf  or  wit  ion  System 

The  Actual  Stats  Information  System  for  a  structural  reliability 
design  systtts  has  amny  of  the  same  funet'.cns  as  the  A3IS  for  the 
present  structural  design  system.  Analyses  are  accomplished,  teats 
are  conducted  and  the  results  of  operation  are  collected.  Numbers 
representing  the  Actual  State  of  the  structural  system  are  generated. 
Individual  segments  of  ths  ASIS  are  described  la  the  section#  following. 

(1)  Analytical  Design  Stage 

The  functions  involved  In  the  Analytical  Design  Stage  of  the  ASXS 
of  a  Purely  Statistical  Structural  Reliability  Design  System  ere 
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depicted  in  Figure  18.  Instead  of  starting  with  the  definition  of 
a  limited  number  of  discrete  conditions  as  in  the  Present  (Factor  of 
Safety)  Design  System,  the  probability  of  attaining  various  operational 
conditions  must  be  calculated.  In  general,  the  statistics  of  one 
variable  are  dependent  on  the  magnitude  of  other  variables.  Thus, 
the  calculation  of  the  probability  of  exceeding  a  condition  defined 
by  several  variables  is  a  complex  task;  but,  theoretically.  It  Is 
possible. 

Loads  analysis  in  the  Purely  Statistical  Structural  Reliability 
System  is  comparable  to  the  same  function  in  the  present  system.  If 
the  load  on  a  particular  component  is  known  for  a  particular 
operational  condition  and  the  probability  of  attaining  that  condition 
is  known,  the  probability  of  attaining  that  particular  load  for  the 
particular  operational  condition  Is  known.  Then,  if  the  probabilities 
of  attaining  that  load  for  all  other  operational  conditions  are 
determinable,  nil  the  probabilities  can  be  combined  to  obtain  the 
total  probability  of  obtaining  the  load.  Repetition  of  the  process 
for  *1  1  load  levels  is  necessary  to  obtain  the  load  spectrum  for  each 
component.  The  process  must  be  repeated  for  each  coiqponent  considered. 
The  distribution  of  failing  strengths  of  each  component  can  be  computed 
using  the  same  strength  analysis  procedures  used  in  the  present  system. 
Additional  statistical  data  must  be  introduced  in  connection  with  such 
parameters  as  dimensional  data  and  failing  stress. 

The  strength  and  load  distributions  can  be  combined  to  determine 
the  probability  of  failure  of  a  particular  component .  Then,  the 
probabilities  of  failure  of  each  component  can  be  used  to  calculate 
the  system  probability  of  failure,  which  Is  the  complement  of  the 
system  probability  of  survival.  The  probability  of  survival  of  the 
system  for  its  operational  lifetime  is  the  structural  reliability. 

The  calculated  values  of  system  structural  reliability  and  the  com¬ 
ponent  probabilities  of  failure  csn  be  compared  to  the  deaired  state 
values.  The  management  decision  on  whether  the  actual  structural 
system  will  achieve  the  desired  reliability  can  be  made  an  the  basis 
of  tnis  comparison.  However,  the  same  problems  of  accuracy  in  the 
loads  and  strength  analyses  that  occur  in  the  Present  System  will 
occur  in  the  Structural  Reliability  System.  In  addition,  more  problems 
will  occur  in  predicting  the  various  probabilities  concerned.  There¬ 
fore,  an  analytical  calculation  of  probability  of  failure  and 
structural  reliability  cannot  be  considered  to  be  accurate  enough  to 
serve  alone  as  the  ASIS  in  a  structural  reliability  system.  References 
3  through  8  discuss  various  aspects  of  the  error  problem  in  determining 
structural  reliability.  Experimental  or  test  data  ar  n  sded  more  than 
ever  to  verify  the  predicted  values.  Reference  8  shears  ina,t  the 
actual  structural  reliability  drops  to  approximately  C.9  whether  the 


intend'd  value  was  C.99  or  G.9vyy99  wiw  the  error  frequency 
documented  in  Reference  17  ie  introduced  Into  the  calculation.  It 
is  suspected  that  ac-st  structural  designers  hire  on  intuitive  under¬ 
standing  of  the  lack  cf  accuracy  in  the  purely  statietioal  onelyeie 
of  the  problem.  This  is  the  basis  for  their  usual  rejection  of  the 
struoturei  reliability  concept. 

(2)  Strength  Test  Stage 

■  As  shown  on  Figure  19,  the  Strength  Test  Stage  as  presently 
constituted  does  not  function  directly  as  an  ASIS  In  the  structural 
reliabaJLlty  design  systea.  Meaningful  measurements  of  structural 
reliability  or  probability  of  failure  for  comparison  with  the  DSIS 
values  simply  ere  not  possible  with  one  or  two  strength  tests. 
Hundreds  or  possibly  millions  of  tests  would  be  required  to  define 
accurately  the  statistical  characteristics  of  the  structural  systea 
to  a  degree  compatible  with  the  desired  reliability. 

Ac  shown  an  Figure  19  the  end  result  of  the  test  is  to  correct 
j  the  strength  analysis  where  errors  aye  disclosed.  This  correction 

I  leads  to  revised  prediction  of  the  strength  spectre  and  of  the 

j  structural  reliability.  Unfortunately,  these  S.R.  predictions  still 

]  incorporate  aony  errors  that  were  present  in  the  original  prediction. 

1  The  contrast  between  the  Strength  Test  Stage  ASIS  in  the  Structural 

I  Reliability  systea  and  In  the  present  M.S.  system  ie  marked.  In  the 

Present  M.S.  systea,  the  Strength  Test  Stage  can  stand  by  itself  as 
|  a  measuring  system  to  furnish  information  for  management  decisions 

i  Even  if  there  is  no  analysis  at  all,  the  structural  system  could 

!  be  defined  on  a  trlal-and-error  basis.  The  Strength  Test  Stage  alone 

|  could  function  to  accept  or  reject  the  resulting  design.  5uch  a 

]  situation  does  not  exist  in  the  Purely  Statletlcal  Structural 

i  Reliability  System. 

!  (3)  Flight  Teat  Stage 

As  shown  on  Figure  20,  the  flight  Test  Stage  does  not  function 
as  an  ASIS  to  the  extent  it  does  in  the  present  systea.  The 
principal  jxirpoae  the  flight  test  serves  is  to  reviss  the  loade 
j  analysis  as  necessary.  A  typical  flight  test  pragraa  does  not  and 

cannot  provide  information  on  the  probability  of  exceeding  given 
flight  conditions.  Even  if  the  attwgrt  were  made  to  obtain 
statistical  data,  the  success  of  the  program  would  be  problematical. 
There  is  always  a  question  whether  the  statistics  of  operations 
during  a  test  program  represent  the  statistics  of  operations  that 
will  occur  under  the  control  of  the  normal  user.  Furthermore,  the 
flight  test  program  ie  usually  constrained  by  cost  consideration*  to 
represent  a  vary  small  portion  of  the  total  usage,  which  refute*  the# 
possibility  of  obtaining  any  weaning  fbsl  stafcitfciaol  data. 
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(4)  Operational  Failure  Stage 

Hie  Operational  Failure  Stage  of  the  ASIS  in  the  Purely  Statis¬ 
tical  Structural  Reliability  Design  System,  as  shown  on  Figure  21, 
must  necessarily  perform  a  different  function  than  does  the  same 
segment  of  the  Present  Structural  Design  System,  as  shown  on  Figure  16. 
The  principal  difference  is  that  the  investigating  group  will  find 
it  almost  impossible  to  determine  a  "cause”  for  any  failure. 
Determination  of  a  cause  implies  a  discrete  action  that  is  incompatible 
with  the  concept  of  the  randosness  of  the  parameters  affecting  a 
structural  reliability  analysis. 

Consider  the  situation  where  a  failure  occurred  at  a  flight 
condition  that  had  been  predicted  to  occur  in  one-in-a-hundred  (or 
one-in-a-million)  vehicles.  Can  the  user  who  operated  the  vehicle 
at  that  condition  be  assigned  the  responsibility  for  causing  the 
failure?  If  the  vehicle  failed  at  a  load  that  only  one-in-ten-thousand 
vehicles  should  fail  at  according  to  the  analysis,  can  a  decision  be 
made  that  something  is  wrong  with  the  structure?  Since  there  is  a 
continuous  and  smooth  variation  in  the  probability  of  occurrence  of 
each  strength  and  load  condition,  hew  can  a  dividing  line  be  drawn  to 
separate  the  permissible  from  the  impermissible? 

Based  on  this  reasoning,  the  information  resulting  from  operations 
must  be  associated  with  the  statistical  analysis.  A a  shown  on  Figure  21, 
information  on  the  number  of  failures  that  have  occurred  during 
operations  can  be  analyzed  relative  to  the  number  of  successful 
operations  to  predict  the  probability  of  failure  and  the  vehicle 
structural  reliability.  The  value  determined  for  one  or  two  failures 
at  an  early  stage  in  the  life  of  the  operational  system  is  not  very 
significant  in  deciding  whether  or  not  the  structural  system  is  ful¬ 
filling  the  desired  state  requirements. 

c.  Other  System  Functions 

Functions  other  than  the  DSIS  and  ASIS  would  be  the  same  in  the 
Purely  Statistical  Structural  Reliability  System  as  they  are  in  the 
Present  System.  However,  the  previous  discussions  have  noted  some  of 
the  difficulties  in  obtaining  information  on  which  to  base  the  many 
decisions  necessary  in  using  any  system. 
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SECTION  III 


EVALUATING  THE  PRESENT  (FACTOR  OF  SAFETY)  STRUCTURAL 
DESIGN  SYSTEM  AND  A  PURELY  STATISTICAL 
STRUCTURAL  RELIABILITY  SYSTEM 


3.1  INTRODUCTION 

Section  II  of  this  report  describes  the  extension  of  Dreper's  lnfometica 
concept  to  the  structural  design  p rob leu.  Considerable  discussion,  couched 
in  informatics  terms,  is  presented  in  Section  II,  aimed  at  developing  an 
understanding  of  he m  the  Present  (Factor  of  Safety)  Structural  Design  System 
functions.  Additional  discussion  is  presented  to  illustrate,  in  an  infor¬ 
matics  framework,  how  a  Purely  Statistical  Structural  Reliability  System 
functions. 

The  purpose  of  Section  III  is  to  convert  this  understanding  into  an 
•valuation  of  the  merits  and  the  problem  areas  associated  with  the  two 
structural  design  systems  outlined  in  Section  II.  In  turn,  this  win  serve 
as  a  basis  for  the  critique  of  individual  papers  dealing  with  structural 
design  criteria  problems,  ^ese  critiques  are  presented  in  Section  IV. 

3.2  GENERAL 


An  evaluation  of  any  system  requires  an  understanding  of  the  purpose 
of  that  system  end  a  measure  of  how  well  the  system  accomplishes  its  purpose. 
A  structural  design  system  is  defined  very  broadly  in  this  paper.  It 
includes  far  more  than  Just  the  structural  design  criteria.  It  includes  the 
state  of  the  art  affecting  strength  and  loads  analysis.  It  includes  the 
drafting  room  procedures  that  affect  the  checking  of  the  structural  drawings. 
It  includes  the  government  material  specifications  and  it  also  includes  the 
know-how  of  materials  producers.  It  includes  fabrication  techniques  in  the 
shop  and  it  includes  maintenance  techniques  in  the  field.  It  includes  tha 
pilot's  flight  handbook  and  it  includes  the  pilot  training  syllabus.  In 
short,  a  structural  design  system  include*  everything  that  has  an  interface 
with  the  structural  system  (coaocnly  called  the  airframe  or  the  hardware) 
and  everything  that  has  a  bearing  on  whether  the  structure  survives  or  not. 

It  is  recognised  that  such  a  broad  definition  of  the  structural  design 
syatem  is  not  universally  accepted.  It  is  acknowledged  that  there  are 
Jurisdictional  problems  in  any  design  organisation  that  inhibit  control  by 
the  structures  organisation  of  all  things  that  affect  the  structural  system. 
Nevertheless,  it  is  necessary  in  any  evaluation  of  a  structural  design 
system  to  recognise  the  existence  of  these  problems.  One  measure  of  the 
effectiveness  of  a  system  is  hew  well  it  copes  with  these  interface  problems. 
Therefore,  the  evaluation  developed  in  this  report  will  not  be  inhibited  by 
any  preconceived  ideas  limiting  the  prescribed  field  cf  responsibility  for 
the  structures  organisation. 
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a.  Function*  of  *  Structural  Design  Syetea 

Th#  fundamental  purpose  of  any  structural  design  system  is  th*  creation 
of  an  operational  structural  *y#t «a  that  will  stable  the  vehicle  to 
satiaf  act  orily  perform  it*  sdeeion.  Th«  desired  art  runt  ur*  do**  not  ainply 
occur.  It  Is  the  result  of  sany  sansgcssat  decider,;  that  trigger  «ot,lcna 
la  Shv  processes  leading  is  ths  final  product.  The  — 1H ng  of  decision*  is 
tb*  key  *1  —at  in  tbs  procedure. 


Th*  bad*  for  evaluating  any  structural  design  system  a»gt  be  ths 
consideration  of  how  effectively  decision*  arc  aad*  and  implemented.  As 
shown  «a  Figure  y ,  tl»«*  basis  rar  thsss  ssasgcssni  decisions  — fe»  th* 
definition  of  th*  Desired  State  of  th*  structural  eyate*  and  the  doteroinatioa 
of  th*  Actual  State.  Hanes,  th*  evaluation  bacoows  largely  an  evaluation  of 
tha  Desired  State  Information  Syotec  (DSIS)  and  th*  Actual  State  Indorsation 
System  (ASIS).  It  is  assumed  that,  if  the  correct  indorsation  ia  presented 
to  th*  senejx— nt.  th*  correct  decision  will  be  forthcoming. 

b.  Standards  of  Evaluation 

From  an  understanding  of  the  crucial  eleaent.e  in  a  structural  design 
system,  standards  dor  evaluating  various  structural  design  systems  can  be 
established.  Th*  following  three  considerations  will  be  used  in  this  report 
as  ths  basis  dor  the  evaluation: 

1.  How  effectively  doss  the  structural  design  cyst  aw  define  the 
Desired  State? 

2.  Hew  accurately  can  the  Actual  State  be  detsnjdnad? 

3.  How  early  in  the  design  and  deployment  cycle  of  th* 
operational  -ystaa  will,  any  discrepancies  between  the 
Desired  State  end  Actual  State  be  disclosed? 

A  discueaion  and  aspli  fioatloa  of  th*  meaning  of  these  stendarun  for 
evaluating  structural  design  systems  will,  be  accoapliehed  in  th*  rewainder 
of  this  report .  This  will  be  done  as  the  evaluation  proceeds  for  the  two 
aysteas  under  consideration 

3.3  PRESENT  (FACTOR  OP  SAFETi)  STRUCTURAL  LSD1GM  ST  STEM 

Th*  structural  design  syctea  that  i*  used  currently  in  th*  design  of 
almost  all  aeroepro*  structure a  is  described  in  Section  II.  The  generalised 
functional  diagraa  showing  how  the  present  systea  operated  is  shown  on 
Figure  10.  Section  II  asplained  the  function  of  the  various  aegsuntt  of 
the  Present  System  as  shewn  on  Figure  10.  Evaluation  of  th*  Present  Systea 
will  be  conducted  as  a  stab  11  shod  in  he  previous  subsect 4.  on. 

a.  Evaluation  of  Deaired  State  Inforswtion  System 

Both  a  strength  and  a  weakness  of  th*  Present  Structural  Design  System 
rc  Ad#  in  the  procedures  that  function  as  th*  DSIS.  The  Present  Systea 
represents  an  eminently  practical  ay  at  sea.  It  las  been  used  for  the  design 
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pegnlatlaeia  m*ah  as  FAR  25.  A  ■or*  reowt  exposition  of  the  prablest  hm 
presented  by  Stlegliti^  at  the  fifth  Reliability  and  Mair.tr  inability 
Qenfercnos.  He  note*  that  'The  nee  of  nmeerlcaJl  goal 3  r«j>'r*i  the  estsbllsh- 
mbI  of  act  acceptable  risk,  leading  1—  rllstaly  to  the  question  of  the  eoral 
aeftBgUfciisty  of  an?  go-sl  other  than  a  wro  fatality  rate."  Sbisgiita 
ocnoluass  with  the  opanico  'that  the  uae  of  nuiaerioal  safety  goals  is  not 
ssrmlly  Justifiable,  would  preiKsit  serious  legal  p’uM—s,  and  la  not 
pnetxaacijt  mas  tns  atanapoiat  or  being  iilmt  ^'oaiotahie  or  da—nstrenle. M 

the  kind  of  th lairing  ohatvyiteriaed  by  this  previous  discussion 
und—btecUy  has  bean  a  —Jor  factor  why  failure  na  ora  structural 
reliability  maker  hare  umr  bean  intagrated  in 00  present  structural 
design  orlfeerla.  Despite  the  fact  that  aooeptanae  of  a  non- aero  failure 
rale  la  an  snath see  to  wany,  the  practical  decisions  that  base  been  wade 
In  the  past  awphaaxae  the  fact  that  a  ssro  failure  rate  is  not  truly  the 
goal.  If  it  were,  bow  oould  anyone  Justify  not  using  a  2.0  or  a  10.0  factor 
of  safety  instead  of  the  conventional  1.5?  Certainly,  increasing  the  factor 
of  safety  by  seen  large  anount  would  reduce  the  failure  rate  by  »am 
undetervinable  anount  but  obviously  so— what  closer  to  sero  than  it  now  is. 

In  this  reaped,  actions  speak  louder  than  words.  A  significant 
nuber  of  aatsutrojphle  structural  failures  have  occurred  to  Military 
fighter- type  aircraft  over  a  span  of  years.  It  is  eat letted  that  sonewhere 
between  one- in-tan  and  one-ln-one-thouaand  fighters  have  failed  structurally 
In  the  past.  The  inald&ace  cf  failure  on  transport  aircraft  la  leas  than 
this  but  certainly  such  greater  than  sero.  In  the  past  quarter  century, 
transport  structural  failures  nuber  in  the  dossns.  The  nuebere  of  •pafeicl'ts 
Involved  are  la  the  team  o£  thousands.  rate  is  not  likely  to  os  better 
than  ciit-iii-t .  Certainly,  th*  true  figure  oust  be  between  one- 
ln-Sr-thousand  and  cna-ln-a-adlllon.  It  should  be  understood  that  this 
failure  rat*  does  not  include  only  those  accidents  listed  In  official  records 
a*  structurally  sstsad.  If  the  pilot  polls  too  bard  co  the  elevator  control, 
developing  a  load  factor  beyond,  th*  structural  capability  of  the  vehicle, 
the  failure  way  be  listed  as  pilot  error.  The  fact  rewslna  that.  If  the 
structure  had  been  twice  aa  strong,  the  failure  would  not  have  occurred. 

This  portion  of  the  discussion  can  be  su— arised  by  stating  that  there 
ia  eons  undefined  level  of  structural  failure  for  various  types  of  aero specs 
vehicles  that  is  acceptable.  The  acceptance  is  Indirect  and  is  expressed 
by  Inaction  in  ohanglng  structural  design  criteria  after  an  accident  occurs, 
Philosophically  and  practical  ly,  this  is  a  very  good  ay  stew  for  all 
oaoeerned. 

(3)  Generalised  Structural  Desigs  Criteria 

The  upshot  of  this  ays teat  is  that  there  is  no  direct  connection 
between  the  Desired  State  of  a  Seasonably  Low  Total  Failure  Bate  and  the 
Qrserallsed  Structural  Design  Criteria.  For  this  reason  the  connection  Is 
shown  os  a  dotted  line  on  Figure  10.  As  a  result  tbs  only  direct  control 
of  the  Generalised  SBC  Is  Me.  igewnt  Action  instigated  fay  a  Menageawnt 
Decision  aa  illustrated  no.  Figure  10*  In  turn,  the  Mauag— 1  Dedal  on  la 
Influenced  by  two  functions.  The  first  reprsswts  ths  Subjective  Conal dera- 
tlcue  noted  on  Figure  9.  A  decision  on  ths  require— nt  a  can  be  — de 


completely  arbitrarily  by  the  appropriate  authority  in  the  customer's 
wn»<imt  organisation.  0  an  anally,  such  decisions  are  Bds  on  the  basis  of 
what  would  be  ounsidered  good  Judgment,  Harqr  ocn sia*reti oris  that  are  ill~ 
deilned  or  undafinabi*  mist  be  integrated  to  arrire  at  t  decision.  In  Major 
questions  involving  Six;,  a  oenssnsus  ie  usually  obtaiasa  in  the  oustoejar's 
organisation.  More  often  than  not,  lr»stetry  perecunel  meet  in  cond-tt 
to  revisv  SDC  decisions  and  r=oc=-svS  appropriate  changes,  Revert balsas, 
the  final  decision  cn  generalised  SDC,  auoh  as  MIL  JU236G  ami  Fife  i>.  ie  an 
arbitrary  uu«.  The  criteria  is  what  It  ie  beoauae  ecsmene  la  authority  eaya 
It  ie. 

iyp±r?.ll ?,  ohiijgsn  to  criteria  mlrmrif  in  uae  are  triggered  by  a 
failure  or  series  of  failures  that  are  oonaidsred  to  be  "too  suny."  The 
structural  design  criteria  used  for  aost  aerospace  designs  have  developed 
largely  in  response  to  specific  problems  that  have  occurred  in  the  past, 
this  is  the  second  function  Mentioned  earlier  that  dsteminee  Kanageasnt 
Decisions. 

Functionally,  the  ingtetua  for  a  change  starts  with  the  decision  by  an 
investigating  group  identifying  the  "cause"  of  an  accident.  This  leads 
to  a  decision  on  whether  the  cause  was  structural  or  non- structural.  If 
non- structural,  no  corrective  action  involving  the  SDC  ie  necessary.  If  the 
cause  is  structural,  the  corrective  action  nay  be  to  change  the  SDC;  or  it 
■ay  be  to  change  ecsae  asnufacluring  or  quality  control  procedure. 

Che  more  source  of  charge  to  the  SDC  stay  rtm  fron  an  eajslleit  change 
in  the  {-.BBigassEst  of  responsibility.  A  simple  araaplo  of  this  type  of 
Kanagsaamt  Decision  was  the  incorporation  of  special  requirements  tar  access 
doors  fastened  ^ith  qc .ick-action  devices.  A  mufeer  of  years  ago,  a  series 
of  incidents  occurred  irlth  doors  of  this  type  cosing  loose  in  flight. 
Initially,  the  decision  was  to  iag>rove  the  performance  at  the  line  Mechanics 
and  inspectors  to  be  sure  the  fasteners  were  properly  tightened  before 
flight.  This,  in  effect,  was  a  decision  that  the  cause  was  non- at ructural , 
so  no  action  was  taken  to  change  the  SDC.  As  tine  went  on,  it  became 
obvious  that  the  problem  was  not  being  solved  on  the  flight  line.  A  new 
decision  was  aade  to  change  the  SDC  to  require  that  the  structure  tolerate 
and  survive  eaaw  ,'oose  fasteners.  The  division  of  responsibility  is  still 
arbitrary  but  at  a  different  level  than  originally.  The  present  requirement, 
sot  forth  in  MJjL-A-SSvI,*0  states  that  any  one  fastener  along  any  critical 
edge  of  the  door  aust  be  considered  to  be  unfastened  and  the  door  must  not 
fail  under  the  appropriate  flight  loads.  The  arbitrariness  of  the  decision 
rests  in  the  transfer  of  responsibility  for  preventing  the  failure  from  the 
line  Maintenance  organisation  to  the  structural  organisation.  However,  if 
More  than  one  fastener  la  loose,  the  responsibility  rn— Inn  with  the  line 
Maintenance  organisation. 

One  further'  consideration  that  is  a  factor  in  evaluating  the  preamt 
system  Is  the  decision  isgtllcit  in  no  action.  Since  the  generalised  SDC  in 
effect  at  any  given  tine  represents  the  distillation  of  the  answers  to  all 
the  problems  of  the  past,  it  is  assumed  to  be  adequate  to  define  a  new 
structural  system  In  the  absence  of  any  evidence  to  the  contrary.  Thus, 
there  Is  no  Motivation  for  the  individuals  responsible  for  the  SDC  specifica¬ 
tion  to  sake  changes  too  quickly  and  rn  cordeenation  for  failing  to  institute 
a  change  until  the  evidence  is  overwhelming. 
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the  mm  token,  11  binnii  Ttry  difficult  to  anticipate  problaaa  { 

•ad  «ak*  SeC  eking**  b*f*r*  *U*h  action  i»  foroed  by  physical  evidence  of  i 

tailor**.  Redaction*  is  criteria  raqul marti  or*  Marly  impossible  to 
Mhi«w.  Sis**  so*t  riq^r»wnt.i  are  the  response  to  part  prohlesw,  th* 
acceptability  of  th*  reduction  or  elimination  of  th*  r*<yilrwnt,  is  ooo- 
oQ  proof  that  tbs  pr*bi«s  will  sot  r*oar.  such  proof  is  nearly 
impossible  to  («Mnu.  is*  aufiouitj  is  eilwinatiag  requirm sots  is 
eeaf-canded  by  ths  fact  that  assy  instance*  of  ip^mt  VI  lari  nation  cf  a 
proaian  mm  oaaorsa  is  uw  post  only  to  bars  to*  proolew  anas  again  to 
wafasii  th*  experts.  Thar*  la  a  natural  reluctano*  an  ths  part  of  all 
iWHMimst  with  establishing  SDC  to  be  placed  la  suoh  as  untenable  position. 

As  a  result,  it  la  mh  easier  to  avoid  "rooking  ths  boat." 

Th*  fandaMOtai  problem  ar*a  Is  establishing  vtruotural  design  critsrla 
for  ths  Pr*ssnt  (Factor  of  Safsty)  Structural  Dsalgn  System  Is  that  thsr* 
la  no  identifiable  objective  that  ths  SDC  la  lntandad  to  satisfy.  Tns 
Present  SDC  la  principally  ths  snrolutianary  rasult  of  raaotion  to  past 
problsM. 


(U)  Vahids  Structural  Dsalgn  Critsrla 

Th*  WoAcle  Structural  Dsalgn  Criteria  represents  the  oouT«r&icr>  of  ths 

Generalised  SDC  Into  SDC  applicabla  to  a  particular  vehicle  aystosu  Such 
parwasWr*  aw  stpostd  cud  limit  load  factor  are  defined  aa  specific 

axatoere.  As  ahum  is  Kigvr*  IQ,  hunago&jtit  Decision  can  result  in  a  vehicle 
aposificatiaa  that  establishes  deviation#  or  additions  to  ths,  requi  recants 
of  ths  Omarallstd  SDC.  Thsa*  art  ths  results  of  negotiations  batman 
cuatcmr  and  ocntractnr.  In  aaay  caasa,  suoh  deviations  represent  a  response 
to  mw  problsM  that  have  arisen  but  which  have  not  yet  resulted  in 
modi floatlona  to  ths  Generalised  SDC. 

In  aany  oaaea,  no  Gsnsralisad  SDC  is  available  for  particular  classes 
of  vehicle*.  Zb  «uoh  oases,  it  is  necessary  to  develop  th*  Veolcl?  SDC 
"ab  initio"  without  benefit  of  any  guidance  frvm  a  Csnerellsed  SDC.  This 
is  both  aa  advantage  and  a  disadvantage.  Thera  is  greater  flexibility  in 
tailoring  tbs  SDC  to  ths  peculiar  needs  of  a  particular  vshid*  aysteau  On 
th*  other  hand,  experience  has  shown  that  program  managers,  botn  in  th* 
customer  and  oontraotor  organisation*;  nay  be  unaware  of  eoaw  of  the 
structural  problem*  that  have  ooourred  can  ilallir  rehiolaa  in  the  past.  A 
Generalised  SDC  ocntisail*.  fay  a  central  organisation  group  tends  to  reflect 
a  broader  knowledge  of  all  tbs  potential  problsau. 

However  it  la  arrived  at,  there  scat  b*  acne  formlrtion  of  the  structural 
requirement*  for  a  particular  vehicle.  Bran  whan  th*  saws  organisation  baa 
th*  responsibility  for  foraulatii^  ths  requiremmt*  end  jjqpl—ntlng  then, 
there  should  be  a  foraal  doaowntatiou  of  the  regul  rswsnta.  This  dooumte- 
tion  for  th*  struct  oral  system  is  usually  known  as  ths  structural  design 
criteria.  If  th*  requirements  are  not  ctocumnted,  there  wuat  be  some 
informal  understanding  of  what  1*  suspected  cf  th*  structural  system.  Th* 
faot  that  th*  SDC  oee  be  changed  aa  often  aa  Vm^emmst  Decision  decrees 
doe*  not  negs'e  tbo  fact  that  there  1*  an  ftnc  extant  at  all  tiwss  in  th*. 
deva2.jpwant  of  a  vehicle  aywtma.  The  Vahids  SDC  in  the  Present  Structural 
Syetew  has  *11  th*  edvwstagee  and  disadvantages  ascribed  to  th* 
Generalised  SDC. 


-  Uh  ~ 


I 


(5)  Design  Conditions  (Lisd.t ) 


Tbs  rsgulr  mi  wit.  ■  established  hy  the  Vahids  SDC  are  tr«o«fwSsi  into 
discrete  conditions  that  the  structural  aystan  anst  sustain,  lbs  ecpaeotlgp 
Iron  the  Vshiels  SDC  to  the  Design  Conditions  (LixLt)  is  shown  dotted  au 
Figure  10.  This  is  done  because  tbs  Istsnrinatloc  of  these  dsatn  earfitiong 
is  typically  ecccapiiahsd  as  part  of  the  Aaslytiesl  Design  Stage  In  the  ISIS. 
To  illustrate  this  eigniricsat  point  further,  ocvii «r  what  would  happen  if 
the  asjriwia  speed  sn  airplane  could  attain  in  a  dive  were  errtsi'xeui Jy 
calculated.  The  Desired  State  of  the  Structural  fasten  would  be  to  show  a 
positive  M.S.  for  the  loads  associated  with  the  erroneous  Vul*>citj .  Jf  the 
airplane  could  easily  sjwssd  the  ©aloolatad  dir*  velocity.  tha  srtrsst™-- 
sight  fail,  wren  though  achieving  the  Desired  3tate.  This  would  be 
equivalent ,  in  Draper's  control  system  analogy,  2  t0 

having  the  directional 

heeding  leessured  by  a  c<aq>aea  and  always  having  that  heeding  fed  Into  the 
aysteei  that  detendnea  the  desired  oospaas  heading.  In  ouch  a  case,  there 
never  would  bo  a  discrepancy  between  the  desired  heading  and  the  actual 
heading.  likewise,  there  la  no  Independent  relationship  between  the  Vehicle 
SDC  and  the  Design  Conditions. 

One  consideration  that  will  aid  In  the  development  uf  Structural 
Integrity,  regardless  of  the  Manner  in  which  the  Design  Condition*  are 
established,  is  the  transformation  of  theca  Design  Conditions  into  Operational 
Ilalbatioes,  -as  shewn  cu  KLgii r*  10 .  m  the  above  case  of  a  adscalculatad  dive 
velocity,  the  oGusequeocea  of  the  error  are  wrl.nl  ml  ami  if  the  pamisaible 
operational  conditions  are  oonsiatant  with  the  Design  Conditione  and  if  the 
Operational  limitations  are  affectively  tranaaJLtted  to  the  vehicle  user. 

The  nuabera  repressntirg  the  Design  Conditions,  right  or  wrong,  becoaw 
the  controlling  parameters  in  defining  the  Desired  State  of  the  Structural 
9y  at  an.  In  evaluating  the  Preswit  Syjrton  the  availability  of  discrete 
nuabera  aust  be  ccneidered  as  an  advantage.  There  is  no  uncertainty  as  to 
what  conditione  the  vehicle  should  survive.  Thin  is  shown  on  Figure  10  as  a 
situation  of  Zero  Failure  at  Unit  Condition.  If  a  failure  should  ever 
occur  at  liait  conditions  or  less,  there  is  no  question  of  the  "cause "  of 
the  failure  and  the  assignamnt  of  responsibility  provided  such  failure  is 
within  the  specified  operatlonrl  Unite  awl  which  is  a  region  considered  to 
be  safe  and  peratLsaible.  Thus,  the  user  of  the  vehicle  cannot  be  held 
responsible.  The  responsibility  for  the  failure  necessarily  resides  soss- 
whore  In  the  structural  systesu  This  unequivocal  assignment  of  responsibility 
has  bean  associated  often  with  an  indication  that  the  present  system  is 
practical  and  adainlstrebls. 

(6)  Factor  of  Safety 

Agra aw  ant  on  ths  weening  and  function  of  the  Factor  of  Safety  has  b 
something  less  than  univeiaal,  aver  since  the  concept  was  Introduced  in 
Many  engineers  consider  that  it  was  the  ratio  of  ultimate  to  yield  stress  ior 
the  aluminums  and  steels  coamon  at  that  time.  Others  cooaider  it  it  an 
ignorance  factor.  In  references  4  and  5,  ths  ocncapt  was  developed  that 
the  factor  of  safety  served  two  purposes.  Ckte  was  to  provide  a  strength 
level  sufficiently  above  the  Halt  conditione  so  that  failure  would  "never" 
occur  at  the  ltsdt  conditions  unless  there  was  an  undarstrength  condition 
caused  by  a  grace,  rectifiable  error  in  designing,  fabricating r  or  tuning 
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the  structure.  The  second  purpose  of  the  factor  of  safety  was  to  provide 
some  overload  capability  beyond  the  specified  limit  conditions,  so  that  the 
structure  would  not  fail  unless  the  user  grossly  exceeded  the  specified 
operational  limitation. 

The  present  structural  design  system  does  not  achieve  either  of  these 
possible  objectives  directly.  All  that  can  be  ascribed  to  the  Factor  of 
Safety  in  the  present  structural  design  criteria  is  that  it  is  an  arbitrary 
number  that  defines  the  relationship  between  limit  and  ultimate  loads.  In 
turn,  the  ultimate  loads  control  the  required  strength  level  of  the  structural 
system. 

The  Factor  of  Safety  (F.S.)  for  aircraft  has  been  1.5  for  many  years. 

In  recent  years,  the  F.S.  for  missiles  and  spacecraft  have  differed  frcm 
1.5  in  many  instances.  Since  there  is  no  definitive  objective  inherent  in 
the  Flactor  of  Safety,  there  is  no  standard  of  judgment  to  determine  whether 
the  assorted  values  currently  used  for  F.S.  are  correct  or  not.  The  only 
basis  for  such  an  assessment  is  whether  or  not  there  are  "too  many"  failures. 
Even  if  long  experience  in  the  use  of  a  particular  F.S.  discloees  that  there 
are  "too  many"  failures,  the  F.S.  does  not  necessarily  need  to  be  raised. 

An  alternative  possibility  is  to  increase  the  severity  of  the  Design 
Condition  (limit).  The  possibility  of  an  infinite  number  of  arrangements  of 
limit  conditions  and  Factor  of  Safety  is  the  source  of  much  of  the  controversy 
over  the  proper  choice  of  Factor  of  Safety.  Either  school  of  thought  can  be 
right  or  wrong.  Either  a  high  F.S.  and  low  limit  conditions  or  lew  F.S. 
and  more  severe  limit  conditions  can  define  a  structure  that  will  be 
satisfactory.  It  is  one  of  the  weaknesses  of  the  present  structural  design 
system  that  the  choice  cannot  be  made  rationally  and  "proved.”  It  may  be 
overstating  the  case,  but  the  management  decisions  that  control  the  Factor 
of  Safety  are  made  principally  on  the  basis  of  subjective  considerations, 
including  the  predilections  of  the  persons  involved. 

(7)  Design  Ultimate  Loads 

The  Design  Ultimate  Loads  that  are  a  vital  part  of  the  ASIS  are  derived 
from  the  Design  Conditions  (Limit).  However,  the  derivation  is  not  a 
direct  process  that  can  be  considered  an  independent  part  of  the  Desired 
State  Information  System.  As  was  the  case  with  the  definition  of  the  Design 
Condition  (Lindt),  so  it  is  with  the  Design  Ultimate  Loads.  These  loads  are 
calculated  as  part  of  the  ASIS  operation.  Limit  loads  are  calculated  for 
the  conditions  designated  as  Design  Conditions.  These  li.-a._t  loads  are 
multiplied  by  the  Factor  of  Safety  to  obtain  the  Design  Ultimate  Loads. 

Figure  10  shows  that  the  loads  analysis  becomes  the  direct  source  of  the 
Design  Ultimate  Loads  that  define  the  desired  strength  of  the  Structural 
System.  Therefore,  a  dotted  line  connection  is  shewn  between  the  Design 
Condition a  (Limit)  and  the  Factor  of  Safety  to  the  Design  Ultimate  Loads. 

(8)  Positive  Margin  of  Safety  for  Design  Ultimate  Loads 

The  Margin  of  Safety  (M.S.)  is  shown  cn  Figure  ID  as  one  of  four 
parameters  that  affect  the  Management  Decision  on  a  Structural  System.  The 
Margin  of  Safety  represents  the  increment  in  actual  strength  of  the  system 
over  the  required  strength  as  defined  by  the  Design  Ultimate  Load.  The  M.S. 
is  typically  expressed  as  a  decimal  fraction.  Actually,  Margin  of  Safety 
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Is  i  mlancaer.  Contrary  to  the  belief  of  eomo  engineers  who  should  know 
better,  an  M.S.  of  +  0.01  does  not  necessarily  a »an  that  the  structure  io 
"safe"  in  the  sense  that  it  will  never  fail.  Likewise,  an  H. 3.  of  -  0.01 
does  not  moan  that  the  structure  is  "unsafe." 

The  Margin  of  Safety  is  a  major  parameter  in  the  oontrol  of  the 
structural  configuration.  It  is  a  ccr.renisnt  administrative  tool.  A  zero 
M.S.  represents  the  line  of  demarcaticr  between  a  structure  that  ooaplies 
with  the  requirement s  of  the  SDC  and  one  which  does  not.  All  questions  of 
compliance  are  related  to  the  Margin  of  Safety  so  the  parameter  should  be 
considered  as  a  contractually  important  itea.  Whether  or  not  a  positive 
M.S.  corresponds  to  a  "safe"  structure  depends  on  the  correctness  of  the 
snc=  the  acaurgay  of  calculation  of  ussign  oonctiiisns,  design  loads, 
structural  strength,  and  freedom  from  err ora  in  the  structural  fabrication 
process. 

The  strength  and  weakness  of  a  positive  M.S.  as  the  definition  of  the 
Desired  State  of  the  Structural  Systsn  it  essentially  as  stated  above.  It 
is  the  basis  for  an  easily  adminlstrabl#  procedure  to  accept  or  reject 
structural  systems.  It  will  provide  a  satisfactorily  high  structural 
integrity  If  the  "new"  ay  stems  are  comparable  to  the  "old"  systems  that 
resulted  in  the  current  SDC  and  if  no  gross  errors  are  made  in  implementing 
ths  SDC  requirement  a .  However,  the  structural  system  that  has  no  negative 
M.S.  does  not  have  any  definable  level  of  structural  integrity.  In  fact, 
where  the  "new"  structural  system  involves  significant  departures  from  the 
characterlatioe  of  the  "old"  systems,  ths  "new"  system  may  develop  an 
unsatisfactorily  high  failure  rate  even  while  complying  with  the  SDC  and 
showing  positive  M.S.  for  all  structural  components. 

(9)  Zero  Failure  at  Lindt  Condition 

The  last  of  the  four  functions  that  define  the  Desired  State  in  the 
Present  SDC  is  that  there  should  be  Zero  Failures  at  Lindt  Condition.  This 
situation  does  not  get  quite  as  much  attention  as  the  M.S.  for  ultimate 
loads,  probably  because  the  condition  is  usually  realised  automatically. 

Since  the  Design  Conditions  (Llsdt)  form  the  basis  for  Operational 
Limitations,  there  is  a  general  acceptance  that  it  is  "safe"  to  operate 
the  vehicle  up  to  these  limitations.  Therefore,  if  a  failure  ever  does 
occur  at  limit  condition  or  less,  the  user  cannot  be  held  responsible. 

The  corrective  action  nuet  involve  the  structural  syatasu  Thus,  there  is 
a  direct  correlation  between  any  failure  of  this  type  and  the  Desired 
State  of  Zero  Failure  at  Limit  Condition.  A  single  failure  is  an  indication 
that  the  Actual  State  is  not  as  desired. 

This  sero  fallurs  rate  makes  a  vary  adndnistrable  requirement  -md  one 
that  is  easy  to  definitive  in  a  contract.  The  disadvantage  of  this  function 
as  a  measure  of  the  Desired  State  is  that  the  only  feedback  that  le  available 
to  determine  whether  the  Actual  State  equals  the  Desired  State  is  the  fact 
of  fa* lure  and  the  condi tions  at  the  time  of  failure.  Thia  is  certainly 
an  unsatisfactory  tool  for  measuring  the  Actual  State.  The  indication  of 
an  unsatisfactory  state  cannot  be  given  until  a  failure  has  occurred.  This 
is  obviously  too  late  in  most  situations.  So,  the  fact  that  the  analyses 
and  tests  that  constitute  the  ASIS  provide  no  early  indication  of  the  Zero 
Failure  at  Limit  Condition  must  be  considered  a  disadvantage. 
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As  previously  stated,  a  Fositiv#  Kargin  of  Safety  for  Ultimate  Loads 
usually  provides  the  desired  Zero  Failure  at  Lindt  Conditions.  However, 

If  the  Factor  of  Safety  is  reduced  significantly  below  1.5  or  if  materials 
with  a  large  strength  scatter  are  used,  the  zero  failure  rate  does  not 
automatically  follow,  tine  of  the  weaknesses  of  the  Present  Structural 
Design  System  is  that  there  is  no  provision  for  solving  this  problem. 

h.  j$wg luetic*}  of  Actual  Stats  Information  Systsm 

Che  of  the  major  rcacanc  the  Present,  (factor  of  Safety)  Structural 
Design  ^yete*  h*e  been  so  enduring  is  that-  the  procedures  for  determining 
the  Actual  Stare  have  been  very  easy  to  inclement.  Thus,  the  information 
needed  to  fereauato  sanagaaaut  Decision#  is  readily  available.  At  every 
stage  in  the  design  and  devulopment  of  the  vehicle  system,  an  unequivocal 
answer  can  he  generated  as  to  whether  the  Structural  System  complies  with 
the  3DC  requirement b;  that  is,  whether  the  Desired  State  is  attained. 

It  was  pointed  out  in  Section  II  that  there  are  three  basic  levels  or 
stages  in  the  ASIS  of  the  present  system.  These  are  the  Analytical  Design 
Stage,  the  Test  Stage,  and  the  Operational  Stage,  in  evaluation  of  how 
well  each  of  tnese  stages  contributes  o  the  determination  of  the  Actual 
State  will  be  performed  in  the  sections  following. 

(1)  Analytical  Design  Stage 

The  Analytical  Design  Stage  was  described  in  Section  II  as  providing 
tha  first  prediction  of  the  Actual  State  of  the  M.S.  The  calculated  M.S. 
is  the  end  result  of  thb  chain  of  calculations.  These  start  with  the 
Calculation  of  Design  Conditions,  then  on  to  the  Loads  Analysis,  the 
Strength  Analysis,  end  finally  the  Strength  Analysis  Report.  The  calculated 
K.S.  is  documented  in  the  Strength  Analysis  Report.  This  provides  the 
formal  rsaans  to  perform  the  function  indicated,  for  the  Comparison  as 
as  shown  on  Figure  10. 

The  process  of  calculating  the  Margin  of  Safety  is  thoroughly 
familiar  to  and  wall  understood  by  most  structural  engineers.  This  Is 
obviously  an  advantags  of  tha  present  system.  Any  change  that  is  made 
should  possess  indubitable  advantages  before  tha  change  is  iaplsmsnted. 

The  procedure  is  relatively  simply  and  quantity  of  calculation  is  limited. 

The  M.S.  that  ie  the  and  product  of  the  calculations  may  be  disputable  but 
any  such  disputes  can  be  resolved  by  appropriate  tests.  In  this  respect 
the  Present  System  fulfills  one  of  ths  prerequisites  of  a  good  system  as 
established  by  Coutinho.^  He  notes  that  “there  must  be  a  system  of  timely 
and  simple  tests  to  confirm  ths  predictions.  The  shorter  the  elspeed  time 
between  prediction  and  verification,  the  greater  the  pressure  for  itccuracy 
in  the  prediction. a  Structural  analyses  have  been  subject  to  this  pressure 
for  greater  accuracy  for  years. 

Unfortunately,  these  advantages  are  balanoed  by  two  disadvantages. 

The  first  is  that,  despits  the  fact  that  most  of  the  calculations  are 
accurate,  occasional  errors  are  ooMdtted  which  result  in  the  true  M.S. 
being  negative  rather  than  positive.  The  second  problem  ie  that  periodically 
a  situation  arises  where  the  structure  has  a  true  positive  M.S.  for  all  the 
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specified  conditions  yet  the  structure  will  fail  in  service,  because  of  an 
error  in  defining  the  design  condition o. 

A  further  disadvantage  of  the  Present  System  is  that  the  Strength  Analysis 
gives  no  direct  informtion  on  the  stats  of  the  Structural  System  for  the  two 
parameters  other  than  M.S.,  established  as  part  of  the  DS1S.  The  Desired 
State  of  Zero  Failure  at  limit  Condition  is  not  analyzed  at  all  in  the 
typical  strength  analysis.  The  fact  that  a  positive  M.S.  usually  indicates 
that  a  structure  will  be  free  from  failure  at  limit  conditions  or  less  does 
not  mean  that  the  Present  System  re ally  makes  provision  for  such  a  requirement. 
Besides  the  problem  of  gross  analytical  errors  large  enough  to  cause 
failures  at  less  than  limit  conditions,  there  is  a  problem  that  is  expected 
to  be  more  prevalent  in  the  future.  This  is  the  situation  that  structural 
designs  with  relatively  large  strength  scatters  will  not  necessarily  have 
the  zero  failure  rates  at  limit  conditions  and  reasonably  low  total 
failure  rates  that  have  been  the  characteristic  of  conventional  structures. 
References  3,  4,  5,  6,  and  21  have  documented  the  fact  that  the  failure  rate 
of  structures  with  large  strength  scatters,  or  coefficient  of  strength 
variation  (  y  8) ,  may  be  orders  of  magnitude  higher  than  the  rate  for  more 
conventional  structures.  In  the  past  the  situation  has  been  controlled  by 
avoiding  the  types  of  material  and  structure  that  give  rise  to  the  problem. 

The  positive  M.S.  is  no  real  guarantee  that  the  structure  will  be  satisfactory. 
Current  trends  indicate  that  structures  wit*:  large  strength  scatter  will 
necessarily  be  more  prevalent  in  the  future.  Hot  structures  typically  have 
large  scatters  in  etrongth.  New  materials  each  as  graphite,  beryllium,  and 
molybdenum  tend  to  be  brittle  and  thus  erratic  in  their  strength.  Extremely 
large  oh ell  structures  ouch  aa  used  in  current. and  projected  boosters  have 
large  scatter  in  their  buckling  coefficients,  tong,  slender  columns,  such 
as  might  be  reed  in  truss  structures  in  the  zero-G  environment  of  large 
space  stations,  *re  quite  variable  in  their  failing  strengths. 

It  is  quite  possible  that  the  users  of  the  Present  Structural  Design 
System  could  find  that  they  have  innocently  backed  into  a  dangerous 
situation  without  any  apparent  change  in  the  satisfactory  practices  of  the 
past. 


(2)  Strength  Test  Stage 

The  first  of  the  three  branches  of  the  AS  15  that  involve  testing  is  the 
Strength  Test  Stage.  The  Strength  Test  covers  many  types  of  test.  It 
includes  the  well  kn-jwn  static  test  that  has  been  a  major  factor  for  years 
in  developing  satisfactory  structural  systems.  It  also  includes  other  types 
of  tests  such  as  fatigue  tests,  drop  tests,  shake  tests  and  acoustical  tests. 
In  fact,  as  used  here,  Strength  Test  Includes  any  type  of  test  whose 
purpose  is  to  "prove"  the  strength  of  the  structure. 

For  all  practical  purponas,  the  Strength  Test  can  be  considered  to  be 
the  final  arbiter  of  the  true  M.S.  of  the  Structural  System.  If  the  structure 
fails  at  less  than  ultimate  load,  it  oust  be  redesigned  no  matter  what  the 
calculations  predict.  Usually,  after  a  premature  test  failure  occurs  the 
analysis  is  changed  to  shew,  with  20-20  hindsight,  that  the  failure  was  to 
be  expected.  The  test  requirements  are  easy,  to  administer.  If  the  structure 
sustains  the  load,  this  constitutes  proof  of  compliance.  It  is  an  easy 
resolution  of  any  differences  of  opinion  that  may  have  existed  over  the 
Strength  Analysis. 
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In  order  to  understand  the  real  advantages  and  disadvantages  of  the 
Strength  Test  as  a  part  of  the  total  structural  dewign  system  characterized 
by  Figure  10  it  is  desirable  to  understand  what  is  the  true  function  of  the 
test.  Ref erenoe  21  notes  that  "the  function  of  testing  is  to  act  as  an  error 
discloser,  not  a  reliability  'prover. ' "  It  also  points  out  that  "a  structural 
system  that  does  not  pass  a  test  can  be  rejected  on  the  basis  of  that  test 
even  though  the  passing  of  a  test,  in  and  of  itself,  provides  little  proof 
of  the  level  of  structural  reliability  attained  by  the  system." 

In  terms  of  the  M.S.  the  single  test  does  not  prove  what  the  true 
analytical  value  for  the  M.S.  should  be.  Remember  that  the  K.S.  represents 
the  relationship  between  the  material  allowable  and  the  ultimate  load.  If 
the  allowable  is  higher  than  the  load,  the  M.S.  is  positive.  Reasnfcer,  also, 
that  the  allowable  is  typically  the  strength  exceeded  by  99  percent  or  90 
percent  or  "most"  of  the  material.  An  error  could  exist  in  the  analysis  and 
the  stress  at  some  point  on  the  structure  could  be  higher  than  the  allowable. 
Although  this  corresponds  to  a  negative  margin,  the  test  structure  might 
survive  because  the  particular  test  article  might  happen  to  equal  or  exceed 
the  average  strength.  Thus,  the  single  test  does  not  determine  exactly 
what  the  true  M.S.  really  is. 

On  the  other  hand,  the  test  is  a  nearly  perfect  discloser  of  gross 
errors.  For  Instance,  Reference  53  shows  that  a  structure,  whose  mean 
strength  is  at  limit  load  instead  of  above  ultimate  and  whose  strength 
scatter  is  small,  has  a  10“"*  probability  of  passing  the  usual  strength  test 
to  ultimate  load.  It  is  somewhat  immaterial  at  this  level  whether  the  actual 
failure  occurs  at  65  or  70  percent  of  ultimate  load  so  that  the  apparent  M.S. 
is  minus  0*35  or  minus  0.30. 

The  previous  discussion  is  valid  only  if  the  strength  scatter  is  small, 
as  is  customary  in  past  aerospace  structures.  If  large  scatters  become  as 
prevalent  as  the  earlier  discussion  in  the  Analytical  Design  Stage  indicated 
would  be  likely,  then  there  develops  a  significant  possibility  that  a 
structural  system  whose  mann  strength  is  at  limit  load  will  actually  pass 
the  Strength  Test  at  ultimate  load.  In  such  a  case,  the  apparent  M.S. 
would  be  positive  even  though  the  true  M.S.  is  appreciably  worse  than  minus 
0.33.  In  the  example  given  in  Reference  33  the  true  M.S.  for  a  structural 
system,  whose  mean  is  at  limit  load  and  whose  coefficient  of  strength 
variation  Is  0.20,  is  minus  0.53*  Under  the  assumptions  of  this  particular 
example,  a  structure  with  this  grossly  false  indication  of  the  true  M.S. 
will  be  accepted  once  in  every  160  tests.  This  inability  to  disclose 
analytical  errors  when  strength  scatter  is  large  oust  be  considered  one  of 
the  shortcomings  of  the  Present  Structural  Design  System. 

Another  obvious  shortcoming  of  the  Present  Structural  Design  System  has 
already  been  indicated  to  be  the  situation  that  a  high  level  of  Structural 
Integrity  doeo  not  necessarily  follow  even  if  the  true  M.S.  ie  positive. 

The  mere  fact  tnat  the  structure  passes  a  strength  test  does  not  guarantee 
satisfactory  structural  performance.  The  conditions  tented  are  selected 
largely  on  the  basis  of  the  Strength  Analysis,  eo  that  an  error  of  omission 
in  overlooking  a  critical  condition  in  the  analysis  will  be  perpetuated,  in 
the  test. 
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Another  problem  area  in  validity  of  the  Strength  Test  ae  an  indicator 
of  the  true  M.S.  is  the  accuracy  of  the  test  simulation.  Test  t®ch^^8  , 

have  evolved  over  the  years  to  the  point  where  they  ware  well  understood  and 
generally  satisfactory  for  the  structures  that  were  conventional  up  to 
about  10  years  ago.  In  recent  years  new  considerations  have  complicated 
the  problems  of  test  simulation.  Hot  structure  obviously  represents  one  of 
the  more  critical  problems  in  simulating  operational  conditions.  Meteoroi^ 
impact  is  another  simulation  problem  affecting  space  vehLdea.  As  discussed 
in  the  Analytical  Design  Stage  some  of  these  new  situations  do  not  lend 
themselves  to  a  definition  of  their  Actual  State  by  an  evaluation  of  the 
Margin  of  Safety. 


(3)  Flight  Test  Stage 


The  Flight  Test  Stage  of  the  ASIS  fulfills  an  extremely  important 
function  in  the  Present  Structural  Design  System.  It  plays  a  major  role  in 
confirming  the  loads  on  which  the  M.S.  of  the  structural  system  is  based. 

The  Strength  Test  is  almost  always  based  on  loads  determined  in  the 
Analytical  Stage  as  shown  on  Figure  10.  Thus,  the  M.S.  determined  in  the 
Strength  Test  Stage  is  subject  to  discrepancies  from  the  true  M.S.  There 
have  been  many  cases  documented  where  the  measured  flight  loads  were  signif¬ 
icantly  different  than  the  analytically  predicted  values.  The  accuracy  of 
the  final  flight  test  measurements  is  usually  very  high.  Although  it  is  not 
at  1  unusual  to  obtain  erroneous  data  from  the  initial  instrumentation  and 
calibration,  the  problems  are  resolved  in  most  cases  during  the  conduct  of 
the  flight  loads  test  program.  The  capability  to  repeat  flights  as  necessary 
is  a  major  reason  for  the  high  final  accuracy  of  the  measurements.  Any  time 
that  differences  are  found  between  measured  end  analytically  predicted  values, 
the  instrumentation  is  immediately  suspected.  Accordingly,  the  instrumenta¬ 
tion  is  reviewed  carefully  and  the  calibration  is  rechecked  until  the  cause 
for  the  discrepancy  is  found.  Because  the  other  organizations  concerned  are 
reluctant  to  change  their  analytical  values,  the  flight  test  organization 
usually  has  to  prove  conclusively  that  there  is  no  significant  instrumenta¬ 
tion  error  in  their  final  results. 


Another  beneficial  aspect  of  the  aircraft  flight  loads  test  program 
is  the  capability  to  explore  the  entire  operational  regime,  extending  the 
limits  of  the  exploration  in  small  increments.  This  permits  a  continuous 
evaluation  of  the  significance  of  the  attained  re  stilts  and  a  halting  of 
further  flighta  any  time  the  results  obtained  indicate  a  serious  overload 
situation  is  developing. 

Oie  of  the  weaknesses  in  the  application  of  the  same  structural  design 
system  to  spacecraft  and  launch  vehicles  is  that  the  very  nature  of  these 
operations  inhibits  any  repetitive  testing  procedures.  Furthermore,  almost 
every  flight  is  an  operational  flight  directed  towards  completion  of  missions 
other  than  structural  testing.  Consequently,  the  deliberate  operation  of  a 
apace  vehicle  to  limit  conditions  for  test  purposes  is  extremely  rare.  This 
inevitably  degrades  the  accuracy  of  the  determination  of  the  true  M.S.  of 
space  vehicles  to  a  lower  level  than  has  been  customary  with  aircraft. 

Another  problem  area  ie  that  some  critical  conditions  mey  not  be 
explored  during  the  Flight  Test  Stage.  The  KLectra  problems^  are  an 
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axanfle  of  this  situation.  There  is  no  sure  cure  for  tikis  problem,  but 
widespread  dissemination  of  knowledge  of  such  problems  should  do  much  to 
insure  that  they  do  not  happen  a  second  time. 

Still  another  weakness  of  the  Flight  Teat  Stage  in  developing  vehicles 
with  high  Structural  Integrity  is  the  near  impossibility  of  testing  the 
vehicle  beyond  the  specified  limit  conditions  because  of  the  risks  involved. 
As  a  result,  no  information  is  obtained  on  possible  non-linearities  or  non¬ 
proportionalities  in  the  flight  loads  beyond  the  limit  conditions.  Most 
structural  failures  of  aircraft  occur  during  operation  beyond  the  specified 
limitations.  Non-linearities  may  unwittingly  reduce  the  capability  of  the 
vehicle  to  sustain  overload  to  a  point  whore  excessive  failures  may  occur. 

A  by-product  of  the  flight  loads  test  program  is  the  first  demonstration 
that  the  Structural  System  is  capable  of  meeting  the  second  Desired  State 
shown  on  Figure  10.  The  operation  of  the  test  vehicle  to  limit  conditions 
during  the  flight  loads  program  effectively  demonstrates  the  capability  of 
the  entire  vehicle  system.  If  there  are  any  gross  understrength  or  overload 
situations  that  have  not  been  detected  previously,  they  mey  show  up  during 
the  final  structural  demonstration  flights. 

(4)  Proof  Test  Stage 

As  discussed  in  Section  JI  the  need  for  a  Proof  or  Acceptance  Test 
resides  in  the  fact  that  some  structural  systems  have  a  significant 
possibility  that  an  individual  structure  may  be  grossly  understrength 
compared  to  the  average  strength.  Typically,  proof  tests  are  considered 
necessary  for  pressure  vessels  where  welding  presents  problems  in  obtaining 
perfect  reproducibility  from  one  vehicle  to  the  next. 

An  advantage  of  a  proof  test  is  the  extremely  simple  concept  involved. 

If  the  structure  is  loaded  to  or  slightly  beyond  the  limit  condition,  it 
either  sustains  the  load  or  it  doesn't.  Failure  during  the  test  is  proof 
positive  that  the  structure  in  question  would  not  attain  the  Desired  State 
of  Zero  Failure  at  limit  Condition.  Furthermore,  no  Management  Decision  ie 
really  required  to  upgrade  the  Structural  Integrity  by  removing  the 
defective  article  from  the  operational  Vehicle  System.  The  proof  test 
failure  automatically  does  this. 

The  principal  disadvantages  of  the  Proof  Test  Stage  as  an  ASIS  are 
twofold.  First  the  Proof  Test  is  usually  conducted  for  one  particular 
loading  condition.  Weakness  under  other  conditions  msy  exist  but  not  be 
disclosed  by  the  simple  proof  test.  Also,  the  proof  test  is  most  meaningful 
in  situations  where  a  discrete  maximum  load  occurs  as  in  pressure  vessels. 
When  a  spectrum  of  maximum  loads  occurs  as  in  the  case  of  gust  loads,  a 
proof  test  ie  a  lees  effective  tool. 

The  seocnd  disadvantage  of  the  Proof  Test  is  that  the  test  operation 
itself  may  damage  the  structure  so  that  second  and  subsequent  loads  may  be 
more  likely  to  causa  failure.  Some  lovtars  are  known  to  have  suffered 
from  this  problem.  The  difficulty  Is  confounded  when  repeated  proof  tests 
are  conducted  during  the  manufacturing  process  and  subsequently  during 
maintenance  checks.  A  minor  dieadvantag'  ie  the  difficulty  in  determining 
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whether  a  proof  teat  is  necessary.  This  tends  to  be  a  Judgment  decision. 

As  en  example,  consider  the  case  of  cne  booster  vehiole  which  had  been  in 
production  for  a  considerable  period  of  time.  No  proof  test  failures  had 
occurred  and  it  appeared  possible  that  the  proof  test  requiremenv  should  be 
eliminated.  While  this  suggested  change  was  under  consideration,  several 
proof  failures  occurred.  Investigation  shewed  that  an  apparently  minor 
change  in  welding  technique  had  occurred.  It  is  quite  conceivable  that, 
if  the  failures  had  been  delayed  to  a  slightly  later  period,  the  decision 
to  eliminate  the  Proof'  Teet  might  have  been  implemented.  In  such  an  event, 
the  defective  articles  would  have  entered  the  operational  inventory ,  only  to 
fail  at  a  later,  more  crucial  time. 

(5)  Operational  Failure  Stage 

The  Operational  Failure  Stage  is  the  final  indication  of  the  Actual 
State  of  the  Structural  System.  Like  the  other  stages,  this  stage  represents 
an  imperfect  procedure  for  the  measurement.  An  operational  failure  ie 
obviously  an  undesirable  inatrument  for  measuring  the  Actual  State.  No 
matter  what  failure  rate  ia  conoid ered  acceptable,  no  one  really  desires  a 
failure.  The  Deaired  State  Failure  Rate  is  really  the  maximum  rate 
permiasible.  A  lower  rate  ie  hoped  for.  Nevertheless,  when  an  operational 
failure  does  occur,  it  would  be  negligence  not  to  use  the  available  data 
as  an  indication  of  the  Actual  State  of  the  Structural  Syetam  and  to  make 
Management  Decisions  that  would  tend  to  prevent  similar  failures  in  the 
future. 

In  raary  eit nations  the  cauae  of  the  failure  is  obvious  and  so  Is  the 
corrective  action.  In  other  cases  the  Probable  Cause  Determination  is 
rather  subjective.  The  choice  between  a  non- structural  cause  involving  an 
overload  on  a  satisfactory  structural  system  or  a  pnpperly  operated  and 
loaded  structural  system  failing  by  virtue  of  an  understrength  problem  is 
sometimes  rather  arbitrary.  An  interesting  example  of  how  two  disparate 
decisions  were  made  in  somewhat  similar  circumstances  is  embodied  in  the 
requirements  of  MIL- A- 8861, 20  Paragraph  3.1.15.  (This  discussion  expands  a 
discussion  of  the  same  problem  on  page^  of  this  report.)  The  specification 
requires  that  "doors  and  other  coverings  shall  remain  in  place  under  design 
ultimate  flight  loads  if  10  percent  of  the  fasteners  are  unfastened  or  if 
one  quick  release  fastener  selected  at  random  on  each  edge  of  a  door  or 
panel  secured  by  these  fasteners  is  unfastened."  This  criterion  waa  adopted 
after  a  series  of  incidents  in  which  access  doors  came  loose  during  flight. 
Presumably,  the  initial  determination  was  that  the  cause  was  non-st ructural. 
The  management  decision  waa  that  the  Total  Failure  Rate  waa  too  high  (again, 
"too  high"  is  a  rather  nebulous  concept),  but  the  cause  was  attributed  to 
overload  on  the  structure  due  to  preventable  carelessness  on  the  part  of 
line  mechanics  and  inspection  personnel.  The  Management  Action  as  „  rt  of 
the  System  Control  shown  on  Figure  10  would  be  to  issue  new  instruct  one  and 
perhaps  to  ohange  maintenance  manuals,  clarifying  the  proper  procedures 
for  securing  quick-action  fasteners.  There  probably  were  several  attests 
at  preventing  the  occurrence  of  loose  fasteners,  but  the  situation  continued. 
It  is  inconceivable  that  this  problem  could  not  have  been  solved  some  day, 
given  enough  turns  and  money.  Instead,  a  Management  Decision  was  formulated 
that  required  the  structure  to  tolerate  the  looee  fasteners  without  any 
failure.  This  decision  instantly  converted  what  had  been  a  non-structurally 


caused  failure  into  a  structural  failure.  As  a  result,  the  Management  Action 
now  becomes  a  change  in  the  Structural  Design  Criteria.  This,  in  turn,  defines 
a  new  Desired  State.  Now,  the  ASIS  is  measuring  the  Actual  State  against  a 
different  standard. 

Just  to  emphasize  the  subjective  nature  of  the  decision  involved,  a 
different  decision  was  once  made  in  a  similar  situation.  A  commercial 
airliner  was  designed  with  a  hinged  leading  edge  for  access  to  controls 
and  plumbing  along  the  span  of  the  wing.  The  leading  edge  was  held  in 
place  with  fasteners  of  the  type  being  discussed.  On  one  occasion  the 
leading  edge  was  opened  up  by  the  crew  for  servicing.  Unfortunately,  the 
leading  edge  was  closed  and  a  few  of  the  fasteners  Installed  to  temporarily 
hold  it  in  place.  Subsequently,  the  airplane  took  off  before  anyone 
remenbered  to  tighten  the  remainder  of  the  fasteners.  Almost  as  soon  as 
the  plane  was  airborne,  the  leading  edge  folded  over.  The  lose  of  lift  and 
excessive  drag  on  one  wing  caused  the  plane  to  crash.  In  this  case,  the 
cause  was  determined  to  be  non- structural  and  maintenance  and  inspection 
procedures  were  revised.  No  change  was  ever  made  in  MIL-A-8861  comparable 
to  that  for  small  doors,  even  though  the  problem  is  essentially  the  same. 

The  problem  that  is  inherently  troublesome  in  using  Operational 
Failures  as  a  major  function  in  the  ASIS  is  that  it  is  an  after-the-fact 
function.  The  very  availability  of  failure  data  means  that  something  less 
than  perfection  is  the  Actual  State  of  the  moment .  The  situation  can  be 
corrected  but  it  would  obviously  be  preferable  to  prevent  the  failure  in 
the  first  place.  Use  of  operational  failure  data  is  certainly  an  imperfect 
solution  to  the  problem.  In  spite  of  this,  Structural  Design  Criteria  has 
evolved  almost  exclusively  in  response  to  problems  disclosed  by  failures. 

The  alternative  of  using  operational  successes  to  measure  the  Actual 
State  of  &  structural  system  is  even  less  meaningful.  The  problem  has  been 
identified  by  some  as  the  problem  of  "random  success."  At  the  failure  rates 
usually  considered  to  be  even  marginally  acceptable  for  aerospace  vehicles, 
a  long  string  of  successes  does  not  contribute  much  to  the  information 
regarding  the  Actual  State  of  the  Structural  System. 

c.  Evaluation  of  Other  System  Functions 

Many  of  the  functions  of  the  other  systems  outlined  in  Figures  9  and  10 
are  outside  the  traditional  scope  of  the  structural  design  system. 

Nevertheless ,  they  affect  the  operational  results  obtained  with  the  structure 
and  cannot  be  ignored. 

One  consideration  that  may  be  considered  an  advantage  by  some  but  a 
disadvantage  by  others  is  that  the  Desired  State  specified  in  the  Model 
Specification  and  the  Structural  Design  Criteria  represents  the  minimum 
requirement.  This  means  that,  once  the  Management  Decisd  *  ode  in  the 
Customer’s  organization,  all  Contractor  organizations  mu-3 .  it  the  same 
requirement.  There  is  no  provision  for  optimization  of  ''  equirement  with 
respect  to  weight,  cost,  reliability  of  other  systems,  e.  The  optimization 
that  is  currently  practiced  by  most  structural  analysis  an-  assign  organiza¬ 
tions  is  with  respect  to  providing  the  lightest  weight  or  least  costly 
structure  that,  complies  with  the  minimum  requirements.  On  this  basis  there 
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is  room  for  competition  between  different  contractor  organizations,  yet  there 
ia  a  discipline  in  this  competition  since  all  are  constrained  to  optimize 
to  the  same  base.  There  is  a  "moment  of  truth"  when  the  structure  mat  survive 
the  design  ultimate  load.  From  the  user's  standpoint,  there  is  soma 
question  whether  it  would  be  acceptable  to  have  two  competing  vehicles 
performing  exactly  the  same  mission  but  with  one  having  a  significantly 
lower  strength  level  than  the  other.  It  seems  logical  that  each  vehicle 
design  should  have  the  same  mini mm  capability  so  that,  if  they  were  flown 
side-by-side,  the  user  would  not  be  required  to  restrict  the  operation  of 
one  more  than  the  other,  On  the  other  hand,  the  coiqpetitive  pressures  to 
minimize  weight  and  cost  will  insure  that  the  structural  system  does  not 
exceed  the  minimum  requirements  by  very  much.  Thus,  the  Present  Structural 
Design  System  tends  to  insure  that  all  structural  systems  are  Just  barely 
on  the  high  side  of  the  minimum. 

Another  consideration  that  must  be  listed  as  a  problem  area  is  the  many 
state-of-the-art  items  in  areas  such  as  material  processing,  fabrication, 
inspection,  and  pilot  training  that  affect  the  total  failure  rate  without 
being  controlled  in  any  positive  fashion.  As  a  simple  example  of  this 
effect,  consider  the  following  World  War  II  problem.  All  airplanes  of  that 
era  were  designed  for  the  vertical  tail  loads  assoc' ated  with  an  uncoordinated 
turn  maneuver.  For  the  type  of  laying  that  was  considered  normal  up  to  that 
time,  the  criteria  was  satisfactory.  Sometime  after  cozdbat  operations  over 
continental  Europe  were  initiated  with  B-17's,  a  series  of  vertical  tail 
failures  occurred.  The  failures  were  preoipated  by  the  practice  of  fish¬ 
tailing  the  bombers  at  the  natural  yawing  frequency  in  an  effort  to  avoid 
flak  from  the  ground.  Very  large  yaw  angles  were  developed,  well  beyond 
all  previous  experience.  If  pilot  training  and  pilot's  handbooks  had 
specifically  prohibited  the  maneuver,  the  failures  might  never  have  occurred. 

If  the  pilot’s  training  syllabus  had  specifically  included  practice  in  the 
fishtail  maneuver,  the  problem  probably  would  have  been  discovered  and 
corrected  before  the  banters  went  into  conbat. 

Inspection  procedures  ars  expected  to  prevent  defective  material  from 
appearing  in  operational  vehicles.  The  Present  Structural  Design  System 
makes  Implicit  assumptions  on  the  effectiveness  of  these  inspection 
procedures.  When  new  fabrication  techniques  are  developed,  no  apecific 
provisions  are  incorporated  in  the  Present  Structural  Design  System  to  modify 
the  SDC  if  the  new  techniques  are  not  as  consistent  as  previous  techniques. 

The  difficulties  that  have  been  experienced  in  various  procedures  for  bonding 
materials  is  a  case  In  point. 

Figure  9  shows  that  software  functional 1y  influences  the  operational 
system.  An  example  of  this  ;.u.-Ht  be  the  dispatching  procedures  used  by  an 
airline.  The  success  of  the  ath<*r  forecaster  in  vectoring  transports 
away  from  turbulent  areas  m'  have  an  appreciable  effect  on  the  number  of 
structural  failures.  A  p*ai_Lel  situation  occurs  in  the  launch  operations 
control  of  a  space  wliirie  launch.  The  predicted  winds  aloft  becoms  part’ 
of  the  input  that  deter  nines  the  go-ahead  for  a  launch.  The  more  accurate 
the  msteorological  prediction,  the  less  likely  the  launch  vehicle  will 
encounter  excessive  wind  shears. 

A  major  disadvantage  of  tne  Present  Structural  Design  System  is  that 
there  is  no  explicit  provision  for  defining  the  interfaces  between  structural 
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and  non- structural  syetema  with  an  allocation  of  responsibility  for 
aocosplishing  specific  functions.  This  foraes  decisions  affecting  structural 
design  in  the  Present  Structural  Design  System  to  be  made  on  an  ad  hoc  basis 
rather  than  from  a  predetermined  set.  of  principles. 

d.  Sv&iuation  of  Present  System  Performance 

The  merits  and  demerits  of  the  Present  (Factor  of  Safety)  Structural 
Da&ign  System  hare  bee*>  discussed  at  length  in  the  previous  sections.  One 
cf  the  major  advantages  of  the  Present  System  is  associated  with  the 
generally  high  level  of  structural  integrity  possessed  by  structural  systems 
designs!  under  present  proetduras.  Other  advantages  of  the  Present  System 
are  admi.nl at rabillty  and  eaoo  of  implementation.  The  principal  disadvantage 
of  the  present  system  is  associated  with  the  fact  that  thare  is  nc  clearly 
identifiable,  quantitative  objective  that  the  Present  System  is  expected  to 
satiafy. 

(1)  Structural  Integrity 

The  principal  advantage  of  tho  Present  (Factor  of  Safety)  Structural 
Deaign  System  is  that  it  works.  It  has  provided  a  generally  high  level  of 
structural  integrity  for  the  aerospace  vehicles  designed  in  the  past  30 
years.  Occasional  instances  of  structural  problems  have  been  resolved  and 
generally  have  not  reoccurrod. 

The  system  has  had  the  capability  to  provide  suitable  requirements  for 
a  wd.de  range  of  missions  including  military  fighters,  consaarcial  transports 
and  apace  vehicles.  Each  of  these  classes  of  vehicles  has  a  level  of 
structural  reliability  appropriate  to  'its  mission.  Although  this  level  is 
not  quantitized,  it  is  generally  accepted  that  commercial  transports  have 
a  higher  structural  reliability  than  military  fighters.  The  present  system 
has  developed  in  such  a  way  that  the  proper  level  for  each  class  of  vehicle 
has  bean  provided  indirectly. 

The  very  act  of  defining  limit  conditions  helps  to  insure  structural 
integrity.  These  limit  conditions  are  usually  translated  into  operational 
limitations.  They  obviously  inhibit  tho  exceedance  of  the  design  limit 
conditions.  If  this  were  not  done,  the  vehicle  user  would  have  no  guidelines 
to  safe  and  unsafe  operational  regimes.  By  the  same  token,  the  operational 
limitations  provide  guidelines  for  determining  the  cause  of  any  structural 
failure.  Corrective  action  can  be  taken  only  if  the  problem  to  be  corrected 
is  defined.  If  a  failure  occurs  at  the  specified  limit  condition  or  leas, 
the  operator  cannot  be  responsible  for  causing  ths  failure.  The  structure 
must  be  grossly  understrength.  3ut,  if  a  failure  occurs  while  the  operator 
Is  grossly  eocceeding  the  specified  limitations  thus  using  up  ths  strength 
increment  provided  by  the  factor  of  safety,  the  cause  of  the  failure  must 
lie  with  the  operator.  With  the  cause  established,  it  becomes  apparent 
either'  that  changes  in  the  mode  of  operation  are  necessary  or  that  improve¬ 
ment  )  in  the  design  and  fabrication  of  the  structure  are  necessary.  It  is  a 
vital  element  in  the  preoent  system  that  the  operational  limits  and  required 
strength  are*  deterministic.  Thia  allows  control  of  each,  which  is  essential 
to  good  structural  integrity.  It  provides  an  exact  measure  of  how  much 
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overloading  by  the  operator  must  be  tolerated  by  the  structure.  And  it 
provides  an  exact  measure  of  how  ranch  understrength  9  structure  mist  be 
before  it  is  intolerable  and  obviously  the  result  of  an  unacceptable 
Mistake  in  the  structural  system.  The  Present  System  ha 0  the  inherent 
capability  for  self-correction  to  prevent  repetition  of  structural  problems. 

The  Present  System  has  the  great  advantage  that  resides  in  tried  and 
true  things.  It  is  thoroughly  familiar  to  all  personnel  involved  in 
designing,  fabricating  and  using  structural  systems.  There  are  undoubtedly 
n»ny  considerations  affecting  structural  integrity  that  are  not  defined  in 
structural  design  criteria  and  other  specifications.  Such  considerations 
may  be  covered  by  other  requirements  without  anyone  realising  the  necessity 
for  such  provisions.  These  considerations  are  also  part  of  the  present 
system. 

The  Present  System  derives  ranch  of  its  capability  to  provide 
structural  systems  with  high  structural  integrity  from  a  successful  integra¬ 
tion  of  test  requirements  into  the  total  structural  design  system.  Strength 
tests  such  as  the  conventional  static  test  together  with  shock,  vibration  and 
various  forms  of  fatigue  tests  have  proved  to  be  an  excellent  discloser 
of  errors  in  the  analytical  design  of  the  structure.  Flight  loads  tests  and 
similar  tests  provide  the  same  validation  of  the  loads  analyses  involved  in 
structural  design.  The  higher  the  degree  of  certainty  of  error  disclosure, 
the  higher  the  structural  integrity  of  the  system. 

Proof  testing  is  beneficial  to  structural  integrity  where  repeatability 
in  the  fabrication  process  is  a  problem  as  in  the  case  of  welded  pressure 
vessels.  The  proof  test  comes  close  to  providing  absolute  certainty  that 
the  structure  can  survive  the  specified  limit  condition  although  it  provides 
no  assurance  that  the  st nacture  can  tolerate  operational  overloads.  The 
proof  test  provides  an  increment  of  assurance  for  a  structural  system  that 
is  already  fundamentally  sound. 

(2)  Administrability 

An  important  consideration  in  the  utility  of  any  structural  design 
procedure  is  the  administrability  of  the  procedure.  This  is  not  a  technical 
consideration  but  is  a  very  practical  consideration  that  is  often  overlooked 
by  proponents  of  new  procedures.  In  order  to  incorporate  structural 
requirements  into  the  contract  defining  a  vehicle  system,  there  must  be 
sons  way  to  administer  the  contract.  This  consists  principally  of 
establishing  procedures  to  decide  whether  to  accept  the  hardware  resulting 
from  the  structural  design  requirements.  Since  rational  people  will 
disagree  over  the  Interpretation  and  implementation  of  the  provisions  of  a 
contract,  there  must  be  a  proof-of-compliraoe  procedure  that  can  resolve 
such  disputes.  Proof  of  conpliance  inevitably  means  that  the  requirements 
must  be  quantitixed  in  some  fashion  that  is  demonstrable.  The  Present 
(Factor  of  Safety)  Structural  Design  System  is  eminently  suited  to  proof 
of  compliance  requirements  at  every  step  in  the  design  and  development  of 
a  new  structural  system. 
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MIL-A-886023  ia  siapllfled  by  the  fact  that  no  action  la  required  until  the 
need  for  a  change  becomes  overwhelming.  It  la  a  fair  assumption  and  one 

that  ie  usually  acceptable!  to  all  ocneeiTied  that  structural  design  criteria 
and  other  specifications  represent  all  applicable  past  experience  and  ere 
pertinent  to  future  requirements  until  proved  otherwise.  Maintenance  of 


the  stalM  mi n  rnquiren  nn  ■rrrwemnnt  end .  when  the  need  for  e  change 

becomes  very  obvious,  agreement  is  almost  automatic.  This  situation  is 
easy  to  administer. 


The  deterministic  nature  of  the  Present  System  contributes  to  its 
adninlstrability.  There  are  many  situations  such  as  the  static  test  where 
aiy  useert&inties  are  removed  by  the  either— you-do-or— you-don !  t  nature  of 
the  test.  There  can  be  no  equivocation  in  such  a  situation.  Such  testa 
also  furnish  a  convenient  basis  for  proof  of  compliance  requirement o . 


The  format  of  the  requirements  lends  iter-’?  to  easy  '  uilriotration. 
Definition  of  limit  conditions  is  tied  to  requir*H*nt>ji.  The  limit 

conditions  have  the  characteristic  that,  right  or  wrong,  they  represent 
agreed-upon  conditions  for  the  design  of  the  structural  system.  If  the 
requirements  prove  to  be  wrong,  both  parties  to  a  contract  are  protected  by 
the  need  to  renegotiate  any  new  design  requirements  that  become  necessary 
during  the  development  of  a  new  system. 

The  Margin  of  Safety  represents  a  convenient  quantity  for  defining 
the  amount  the  strength  is  above  or  below  the  required  strength.  It  also 
has  the  virtue  that  it  ia  understandable  by  non- specialized  personnel.  It 
provides  such  people  with  a  psychological  feeling  of  security  in  the  absolute 
safety  of  a  structure  even  though  the  specialist  knows  there  is  no  such 
thing  as  absolute  safety. 

To  meet  the  need  to  assess  responsibility  and  to  take  corrective 
action  in  case  of  failure,  it  is  cotaaon  practice  to  establish  an  investiga¬ 
tional  group  to  determine  the  cause  of  a  failure.  The  decisions  of  such  a 
group  are  facilitated  by  the  characteristic  of  the  Present  System  that  any 
failure  at  limit  condition  is  unequivocally  the  responsibility  of  the 
structural  system  and  any  failure  at  ultimate  load  has  to  be  the  result  of 
overloading  the  system  beyond  the  permissible  limits.  Determination  of  a 
cause  of  failure  simplifies  the  administration  of  the  corrective  action. 

(3)  General  Comments 

The  Present  (Factor*  of  Safety)  Structural  Design  System  is  well  known 
to  a  very  large  group  of  structural  designers  and  analysts  and  to  the  users 
of  the  vehicle  systems  incorporating  structural  designs  developed  in 
accordance  with  the  requirements  of  the  Present  System.  Despite  the  fact 
that  there  are  some  problem  areas  associated  with  the  Present  System,  the 
familiarity  of  the  Present  Design  System  should  not  be  abandoned  for  the 
unknowns  of  a  new  design  system  unless  the  advantages  of  the  new  system 
are  overwhelming.  If  there  is  a  choice  between  modifying  the  Present  System 
to  eliminate  the  problem  areas  or  adopting  a  radically  new  procedure,  the 
choice  should  be  heavily  weighted  in  favor  of  modification. 
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However,  modifications  are  made  with  great  reluctance.  There  ia  an 
understandable  tendency  to  resist  changing  structural  design  criteria  and 
other  design  procedures.  This  is  both  a  strong  point  and  weakness  of  the 
Present  System.  Trivial  changes  are  not  likely  to  be  introduced  so  there 
is  a  desirable  steadiness  in  the  requirembnts.  However,  it  ia  difficult 
to  introduce  desirable  changes  until  the  force  of  circumstances,  such  as 
catastrophic  failures,  demands  a  change.  Reduction  or  elimination  of  a 
requirement  is  nearly  impossible  since  it  is  nearly  iuposaible  to  prove 
that  a  situation  that  once  called  for  the  requirement  will  never  occur 
again  in  the  future.  There  is  an  understandable  reluctance  on  the  part  of 
the  individuals  concerned  to  make  decisions  reducing  requirements.  Caution 
is  justified  by  the  number  of  instances  where  such  a  reduction  was  regretted 
Consequently,  structural  design  requirements  tend  to  increase  in  severity 
over  a  period  of  years.  The  use  of  some  function  other  than  catastrophic 
failure  to  motivate  changes  in  the  Present  System  would  be  very  desirable. 

The  Present  System  does  not  explicitly  define  the  interfaces  between 
the  structural  system  and  other  systems.  There  are  many  inherent  assumption 
built  into  ths  Present  System.  Such  things  as  a  continuance  of  the  present 
state  of  the  art  and  an  assumption  that  the  user  will,  continue  to  operate 
new  vehiclea  ae  he  did  those  of  the  past  are  typical  of  these  implicit 
assumptions.  Since  the  interfaces  are  not  explicitly  defined  and  since 
responsibility  for  particular  actions  is  not  fixed,  the  assumption  is 
periodically  in  error  and  it  becomes  necessary  to  accomodate  the  Present 
System  to  new  situations.  The  parameters  important  to  structural  integrity 
should  be  identified  and  an  unequivocal  responsibility  for  controlling  the 
parameters  should  be  assigned. 

(4)  Problem  Areas 

Lack  of  a  clear-cut  definition  of  what  the  structural  system  and  thus 
the  structural  design  system  is  expected  to  achieve  is  at  the  root  of  All 
problems  related  to  the  Present  (Factor  of  Safety)  Structural  Design  System. 

This  problem  is  eacenpUfled  by  the  desire  to  have  high  structural  integrity 
without  being  able  to  define  or  measure  structural  integrity.  Ae  a  result 
criteria  have  developed  by  reaction  to  problems,  not  as  a  logical  approach 
to  an  objective.  This  is  not  to  say  that  the  Present  System  does  not  produce 
Structural  Systems  with  high  structural  integrity.  But  it  does  it  indirectly 
—  and  sometimes  inconsistently.  As  a  result,  structural  design  criteria 
tend  to  become  rigid  and  sacrosanct.  The  requirements  begin  to  acquire 
the  characteristic  that  they  exist  for  their  own  sake  rather  than  to 
accomplish  a  specified  purpose.  This  characteristic  is  typified  by  the 
lack  of  a  statement  of  objective  in  HIL-A-8860 . 23  it  ia  difficult  to 
question  rationally  the  requirements  since  there  is  no  logical  basis  for 
such  questioning. 

Since  structural  design  criteria  tend  to  evolve  on  an  ad  hoc  basis 
in  response  to  some  kind  of  difficulty,  there  is  an  implicit  assumption 
that  the  criteria  will  provide  a  satisfactory  structure  if  the  conditions 
affecting  the  new  system  are  comparable  to  those  of  the  past.  Since  aero-  1 

space  vehicle  design  is  constantly  expanding  into  new  fields,  the  implicit  1 
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assumption  of  ths  at it us  quo  provides  s  built-in  bias  for  encountering 
future  trouble#.  If  the  objective  were  more  definitiisd,  it  might  be 
easier  to  marshal  all  available  knowledge  to  meet  that  objective  rather 
than  to  satisfy  a  requirement  simply  because  it's  a  requirement. 

As  a  specific  suE&apls  of  ths  prcblss,  it  is  pointed  out  that  the 
chances  of  accepting  a  deficient  structural  design  increase  markedly  when 
the  coefficient  of  variation  in  strength  (the  strength  scatter)  goes  up. 

In  the  past  we  have  avoided  this  possibility  by  using  materials  end 
configurations  that  have  email  scatter.  This  was  accomplished  by  using 
"good  aarospaca  quality"  materials,  ductile  materials  operating  over  a 
relatively  narrow  temperature  range.  Circtsstancee  involved  in  assigning 
for  operation  in  artrasw  envirornwnt#  are  forcing  the  use  of  brittle 
materials  at  very  high  temperatures.  This  results  in  strength  scatters 
that  would  not  have  bean  acceptable  in  the  past.  The  Present  System  has 
no  mechanism  to  cope  with  this  problem. 

Another  problem  area  in  the  Present  System  is  that  the  existence  and 
proof  of  a  positive  Kargin  of  Safety  does  rot  guarantee  that  the  structure 
will  bo  satisfactory.  In  particular,  if  there  are  considerations  in  the 
new  structural  system  that  were  absent  from  previous  designs,  atfch  as 
a  large  strength  scatter,  the  "new"  structural  system  may  be  quite 
inadequate  even  while  showing  a  positive  H.S.  A  specific  example  is  the 
smell  operational  capability  that  might  be  provided  if  the  loads  are  non¬ 
linear  beyond  limit  conditions.  It  is  very  easy  to  show  a  case  where  the 
structure  could  withstand  loads  50  percent  greater  the-  limit  loads  yet 
have  less  than  10  percent  capability  for  exceodir.g  Halt  L.F. 

There  ia  no  direct  provision  in  the  °resent  (F.S.) Structural  Design 
System  to  arrive  at  the  desired  oondition  of  Zero  Failure  at  Limit  Condition. 
It  has  been  achieved  indirectly  in  the  past.  Future  changes  in  the  direction 
of  a  lower  Factor  of  Safety  and  larger  strength  scatters  will  change  the 
situation.  In  the  future  a  aero  failure  rate  at  limit  conditions  may  not 
be  so  automatic . 

Associated  with  the  two  previous  problems  is  the  problem  of  the 
function  of  a  strength  teat  as  a  diecloser  of  error  in  the  strength  analysis. 
This  function  has  been  performed  with  great  accuracy  in  the  past.  In  the 
future,  this  accuracy  of  error  disclosure  will  be  degraded  if  structures 
with  large  a cutters  in  strength  become  necessary  to  fulfill  future  mission 
requirements. 

Validation  of  ths  loads  analysis  will  become  more  of  s  problem  in 
ths  future.  In  particular,  a  ona-ahot  operation  such  as  a  space  vehicle 
is  not  amenable  to  a  thorough  investigation  of  ths  loads  in  all  flight 
regisMS.  Aircraft  flight  loads  programs,  by  nature  of  ths  capability  to 
repeat  flights  as  often  as  necessary,  are  very  thorough.  A  space  vehicle 
or  a  ballistic  missile  will  not  be  instrumented  for  flight  loads  very  often. 
Such  vehicles  will  rarely  be  programmed  to  attain  the  design  limit  conditions. 
The  result  e«u  only  be  sosw  degradation  of  the  contribution  of  ths  Flight 
Test  Stags  to  tha  development  of  structural  integrity  in  the  vehicle. 


The  use  of  ths  well-known  1.5  factor  of  safety  1*  not  justified  on  th< 
basis  of  accomplishing  a  definable  objective.  As  a  result  when  it  It 
suggested  that  tbs  factor  of  safety  b*  reduced,  t her#  is  no  basis  for 
rational  decision.  Good  Jud^ent  aan  be  and  is  used  In  Baking  ouch  decisions, 
but  one  value  cannot  be  "proved "  correct  and  another  wrong. 

Over  a  significant  range  of  values  for  the  /actor  of  Safety.  *ny  masher 
could  be  justified.  Zt  is  pointed  out  on  page  47  that  the  F.S.  serve#  two 
purposes.  It  provides  a  Margin  for  grossly  overloading  the  vehicle  beyond 
the  specified  operational  limitations  and  it  provides  for  a  gross  under- 
strength  in  the  structure.  Considering  the  overloading  question  first,  it 
is  apparent  that  either  a  40  percent  overload  or  a  50  percent  overload  could 
be  considered  a  gross  violation  of  the  operational  limitations.  The  operator 
of  the  vehicle  would  be  just  os  hard  pressed  to  justify  a  40  percent  violation 
as  a  50  percent  violation.  By  a  simple  executive  decree,  any  vehicle  failures 
at  40  percent  overload  could  b*  charged  to  operational  causes.  A  determination 
of  "pilot  error"  is  a  m— on  reflection  of  this.  The  corrective  action  In 
such  cose  is  effectively  predetermined  to  bo  to  correct  the  operational 
practices  that  led  to  the  overload  but  not  to  change  ths  structure.  Obviously, 
the  more  the  Factor  of  Safety  is  reduced  the  sore  dubious  it  is  to  charge  an 
operational  exceedance  with  responsibility  for  a  structural  failure.  It  seems 
obvious  that  it  would  be  unreasonable  to  infer*  a  pilot  that  It  was  "safe"  to 
operate  an  oirplaru  at  5.0  G's  but  gross  negligence  to  operate  it  five  percent 
beyond  at  6.3  G's.  This  would  correspond  to  s  factor  of  safety  of  l.OJ. 

By  the  sssm  token,  it  would  represent  a  gross  departure  from  the 
expected  strength  if  a  structure  failed  at  67  percent  (the  inverse  of  1.5)  of 
the  design  strength.  Such  s  failure  could  not  possibly  be  construed  as  a 
typical  random  variation  in  fabrication.  Such  a  loss  of  strength  could  only 
came  from  same  discrete  end  gross  error  such  as  an  incorrect  dimension  or 
omission  of  a  process  like  a  specified  heat  treat.  With  a  1.5  F.5.  any 
underetrength  sufficient  to  cause  failure  at  limit  conditions  would  have  to 
result  from  a  discrete  error  that  would  be  corrected  rather  than  from  a  random 
variation  that  the  structure  would  be  expected  to  survive.  Essentially  the 
same  statement  could  be  made  if  the  F.S,  were  1.4.  The  understrength  at 
limit  condition  would  be  71  percent  which  still  must  result  from  a  gross  error. 
On  the  other  hand,  a  F.S.  of  1.05  would  require  that  a  failure  at  95  percent 
of  the  design  value  would  have  to  be  called  a  gross  error  while  failure  at 
100  percent  would  be  colled  normal  end  expected.  Such  a  decision  could  be 
justified  only  under  the  most  unusual  conditions. 

The  problem  rests  with  the  foot  that  the  transition  from  the  obviously- 
too-lorge  to  the  obviously-t oo-emoll  Factor  of  Safety  la  gradual  and 
imperceptible .  A  choice  of  a  specific  Factor  of  Safety  Implies  that  any 
leaser  value  is  wrong.  It  must  be  accepted  that  a  waller  F.S.  is  less  good 
but  not  wrong.  The  problem  is  compounded  by  the  foot  that  «u  identical 
structural  strength  can  be  specified  by  increasing  the  severity  of  the 
required  limit  conditions  while  reducing  the  magnitude  of  the  Factor  of 
Safety.  The  dilemma  la  how  to  make  a  rational  choice  of  Factor  of  Safety  in 
the  faoe  of  all  the  subjective  considerations  affecting  F.S. 
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On*  of  th*  principal  problem  areas  of  the  Present  System  is  that  there 
Is  no  appropriate  way  to  define  a  factor  of  safety  for  some  of  the  iwjor 
problem  areas  of  modern  structural  design  such  as  fatigue  and  extreme 
temperatures.  The  Present  Syatea  is  predicated  on  design  for  conditions 
that  are  static  or  quasi-static.  Most  aircraft  designs  prior  to  1?50  did 
not  require  explicit  consideration  of  these  new  problems.  In  terns  of 
defining  the  Desired  3t*te  for  structural  systems  affected  by  fatigue 
or  high  temperatures,  the  relationships  between  the  deoirod  Structural 
Integrity  and  specific  requirements  in  th*  Generalised  Structural  Design 
Criteria  are  more  indirect  than  ever.  Furthermore,  the  difficulties  involved 
in  detsraining  the  Actual  State  of  structural  systems  operating  in  these  new 
anvirormanto  are  compounded.  In  particular,  the  error  disclosing  capability 
of  the  presently  available  teste  in  fatigue  and  thermal  environments  does  not 
appear  to  be  an  powerful  as  the  well-known  static  test.  There  is  a  need  to 
review  the  procedures  involved  in  these  problem  areas  to  find  better  ways  to 
define  the  objective  and  to  measure  the  degree  of  compliance  with  that 
objective. 

3./,  PURELY  STATISTICAL  STRUCTURAL  RELIABILITY  SYSTEM 

The  general  characteristics  of  a  structural  design  system  based  on 
purely  statistical  structural  reliability  considerations  is  described  in 
Section  II.  In  developing  and  describing  the  functional  outline  for  this 
type  of  system,  the  dlacuasion  in  Section  II  necessarily  indicated  some  of 
the  problem  area*.  These  will  be  reviewed  in  the  evaluation,  together  with 
other  considerations  that  affect  the  usefulness  of  a  Purely  Statietical 
Structural  Reliability  System. 

a.  Evaluation  of  Desired  State  Information  System 

As  indicated  in  Section  II,  the  Desired  State  Information  System  is 
simplicity  itself.  As  shown  on  Figure  17,  the  Desired  Stats  is  defined  by 
two  quantities.  The  first  of  these  is  the  Vehicle  Structural  Reliability 
and  the  second,  the  Component  Probability  of  Failure.  In  Draper's  papsr, 
he  indlcatee  that  Desired  State  definition  begins  with  Imagination  and 
Deairaa.  Literally,  anyone  can  choose  any  number  from  zero  to  one  for  the 
desired  structural  reliability.  The  choice,  without  any  necessity  to  explain 
why,  becomes  the  Desired  Stats.  In  the  same  vein,  anyone  can  allocate  a 
value  for  tho  merlmim  probability  of  failure  for  a  given  structural  cosponant. 

The  problem  ia  somewhat  more  difficult  if  the  Desired  State  Values  for 
structural  reliability  are  to  be  selected  on  a  rational  basis.  However,  it 
is  not  anticipated  that  this  problem  offers  any  insurmountable  difficulty  if 
a  structural  reliability  design  system  should  be  generally  adopted. 

Reference  5  recommends  three  levels  of  structural  reliability,  0.99,  O.9999 
and  O.999999,  for  three  level#  of  risk  that  might  be  acceptable  for  different 
type*  of  vehicle*.  There  la  aome  thought  that  the  0.99  figure  might  be 
associated  with  fighter-type  aircraft  and  0. 999999  with  transport  aircraft. 
Referenda  $  recommend*  0.9999  as  th«  choice  for  a  standard  space  vehicle. 
These  recommendations  are  certainly  not  expected  to  be  universally  acceptable. 
They  do  illustrate  that  desired  levels  of  structural  reliability  can  be 
quantitlsed  in  sosw  logical  fashion. 
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Css  praties  in  establishing  structural  reliability  (5.R.)  as  th* 
desideratum  of  atruetural  design  la  the  question  of  precisely  what  la  meant 
by  structural  reliability,  The  tena  is  glibly  mouthed  by  many  but  rarely  la 
there  a  real  comprehension  of  what  it  means.  There  must  be  an  understanding 
of  whether  the  value  is  to  be  based  on  the  aosanptlon  that  all  individual* 
and  organizations  affecting  the  o.R.  perform  as  they  are  assumed  to  perform. 

In  other  words,  should  tha  probability  of  error  be  inciudad  In  the  dsfirdtien 
of  structural  reliability? 

Then,  there  are  three  orders  or  reliability  to  be  considered.  The  first 
la  the  atruetural  reliability  of  an  Individual  vehicle.  As  each  vehicle  ie 
produced,  it  has  an  inherent  strength.  Some  vehicles  fabricated  to  the  same 
specifications  se  olhar*  will  have  e  low  strength.  Seas  will  have  a  high 
strength.  The  lower-strength  vehicle  will  have  a  higher  probability  of 
failure  than  the  higher-strength  vehicle.  This  certainly  does  not  mean  that 
all  low-strength  vehicles  will  fail  before  all  high-strength  vehicles;  but, 
undeniably,  the  probability  of  failure  is  higher.  Thus,  each  individual 
vehicle  as  it  stands  ready  to  operate  has  a  structural  reliability  that  is 
associated  with  that  parti cula*  vehicle  alone. 

A  second  order  of  roll  ability  involves  the  reliability  of  a  group  of 
nominally  identical  vehicles,  typified  by  all  the  vehicles  of  one  particular 
model.  The  atruetural  reliability  of  the  model  is  that  deteradnsd  by  the 
probability  of  success  of  one  vehicle  taken  at  random  from  all  the  vehicles. 

In  a  manner  of  speaking,  the  model  structural  reliability  represents  the 
average  structural  reliability  of  all  the  individual  vehicles  of  that  model. 

On  this  basis  the  model  structural  reliability  may  be  quite  high  yet  an 
individual  vehicle  of  that  model  may  have  a  low  structural  reliability. 

The  one  is  no  guarantee  of  the  other. 

The  third  order  of  structural  reliability  involves  the  general 
reliability  of  all  aerospace  vehiclea  designed  in  accordance  with  a  particular 
procedure.  This  might  bo  thought  of  as  the  structural  reliability  of  the 
complex  of  systems.  The  actual  structural  reliability  of  soma  models- will 
be  higher  than  that  of  others  even  though  they  are  intended  to  be  the  same. 

The  model  structural  reliability  bears  the  same  relationship  to  the  complex 
of  systems  as  the  individual  vehicle  structural  reliability  bears  to  the 
model  atruetural  reliability.  The  structural  reliability  of  the  complex  of 
systems  corresponds  to  the  structural  reliability  of  all  aerospace  vehicles 
from  the  Wright  Brothers'  Flyer  to  the  Apollo.  This  structural  reliability 
represents  the  average  of  all  systems  taken  together.  Since  it  is  an  :v*wage 
value,  an  individual  system  may  be  very  low  compared  to  the  average.  Tiy, 
discussion  in  Section  2.3  of  Volume  II  amplifies  this  concept. 

To  oversimplify  the  situation,  one  might  imagine  that,  out  of  one 
million  systems,  all  but  one  system  had  perfect  structural  reliability 
(that  is,  the  probability  of  failure  is  zero).  The  millionth  system  could 
have  a  zero  reliability  (that  is,  all  the  individual  vehicles  in  that 
system  would  be  certain  to  full).  In  this  case  the  reliability  of  all  the 
systems  taken  as  a  group  is  0. 999999.  This  would  be  small  comfort  to  the 
user  of  the  millionth  system  whloh  has  zero  reliability. 
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This  discussion  of  the  meaning  of  structural  reliability  is  intended  to 
ahoy  that  choice  of  &  structural  reliability  niaaber  to  represent  the  Desired 
State  Bust  be  accompanied  by  an  explicit  definition  of  what  the  tana 
represent. s.  Otherwise,  the  structural  reliability  number  is  meaningless. 

Despite  these  detail  difficulties,  a  vehicle  structural  reliability 
requirement  can  be  considered  to  be  capable  of  fulfilling  the  first  evaluation 
standard  listed  on  page W  vo  affectively  define  a  Desired  State.  The  second 
part  of  the  desired  state  definition,  as  shown  on  Figure  17,  is  the  definition 
of  Component  Probability  of  Failure.  This  function  has  the  dams  difficulties 
as  the  Vehicle  Structural  ttelinbility  Requirement  in  defining  a  precise  meaning 
for  the  parameter.  The  Component  Probability  of  Failure  has  an  additional 
problem  of  definition  that  is  not  generally  recognized.  The  question  is 
whether  the  required  minium  probability  of  failure  of  a  component  should  bo 
considered  Independently  of  the  probability  of  failure  of  other  components. 

The  philosophy  of  allocating  a  share  of  the  total  vehicle  probability 
of  failure  to  each  component  is  basic  to  most  of  the  proposed  structural 
reliability  approaches  that  have  been  published  to  date.  Such  allocation  of 
probability  earrla*  with  it  the  implicit  assumption  that  the  failure  of  each 
component  is  a  random  event,  independent  of  the  failure  of  any  other  component. 
This  assumption  of  independence  undoubtedly  developed  as  an  outgrowth  of  the 
adaptation  of  electronic  reliability  technology  to  the  structural  problem. 
However,  the  assumption  provides  a  false  basis  for  oatablishing  a  desired 
probability  of  failure  for  each  component  in  a  composite  structure. 
Those  who  base  their  formulation  of  the  structural  reliability  problem  on  the 
assumption  of  independence  display  a  lack  of  understanding  of  the  real 
nodes  of  structural  failure  that  must  necessarily  bring  into  question  ths 
credibility  of  their  satire  approach. 

Bouton  ^  noted  that  "the  allocation  of  a  proportionate  share  of  the  total 
mreliabillty  to  eaeh  component,  as  advocated  by  so  many,  is  statistical 
nonsense."  Reference  3  presented  some  figures  showing  how  the  total 
probability  of  failure  varied  with  number  of  components  for  some  simple 
situations.  It  did  not  present  any  formal  analysis  of  the  problem. 
KoLrughlln2^  presents  a  rigorous  proof  of  the  principle  involved  in  a 
similar  situation  and  in  Reference  25  he  extends  the  rigorous  proof  to  the 
case  of  multiple  components  subject  to  a  ooaceon  loading  spectrum. 

In  susauury,  a  Vehicle  Structural  Reliability  Requirement  and  Component 
Probability  of  Failure  provide  a  feasible  basis  for  establishing  the  Desired 
State  of  a  structural  system.  However,  more  rigor  most  be  applied  to  the 
definition  of  the  two  functions  than  baa  been  oommon  in  past  analyses  of 
structural  reliability.  Otherwise,  the  numbers  generated  in  the  solution  of 
structural  reliability  applications  to  structural  design  probleaw  give  a 
oompletaly  false  representation  of  the  true  situation. 

b.  Evaluation  of  Actual  Sta'ie  information  System 

The  functions  involved  in  determining  the  Actual  State  of  a  structural 
system  in  a  Purely  Statistical  Structural  Reliability  System  were  described 
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in  Section  II.  The  same  stages  involved  in  the  Present  System  are  included 
in  the  Structural  Reliability  System.  Their  evaluation  parallels  the 
evaluation  of  the  Present  System  in  Section  3.3  of  this  report,  but  the 
problems  in  establishing  an  Actual  State  Information  System  for  a  Purely 
Statistical  Structural  Reliability  System  are  vastly  different. 

(1)  Analytical  Design  Stage 

The  functional  diagram  of  the  Analytical  Design  Stage  of  the  ASIS  for  a 
Purely  Statistical  Structural  Reliability  Stage  is  presented  as  Figure  18  in 
Section  II.  All  of  the  problems  of  calculating  the  loads  for  specific 
operational  conditions  and  the  internal  loads  or  stresses  for  those  conditions 
are  the  same  as  in  the  Present  System.  However,  the  magnitude  of  the 
computational  effort  is  far  greater  because  of  the  many  coafcinationa  of  load 
and  strength  that  must  be  considered  for  the  statistic^  analysis.  In 
addition,  the  probability  of  occurrence  of  all  of  the  various  operational 
conditions  must  be  calculated  and  then  converted  into  the  probability  that 
the  local  load  or  stress  for  an  individual  co^xment  will  exceed  various 
values.  It  is  a  moot  question  whether  any  of  the  papers  presently  available 
on  the  subject  have  realistically  considered  the  nagnltude  of  the  total 
computational  effort  involved  in  computing  the  probability  of  failure  of  a 
reasonably  large  selection  of  components  and  the  structural  reliability  of 
the  vehicle  as  a  whole. 

Granting  that  the  calculations  can  be  accomplished  if  sufficient  man¬ 
power  and  money  are  available,  the  computations  are  still  subject  to  all  the 
errors  in  the  loads  and  strength  analyses  of  discrete  conditions  as  discussed 
in  the  evaluation  of  the  Present  System  in  the  previous  sections  of  this 
report.  Added  to  this  will  Inevitably  be  occasional  errors  in  predicting  the 
spectra  of  operational  conditions  and  other  probabilities  contributing  to  the 
calculation  of  probability  of  failure. 

Reference  8  documents  the  magnitude  of  the  problem  when  It  shows  that 
the  theoretical  structural  reliability  calculated  under  an  assumption  of  no 
error  in  the  strength  analysis  may  drop  from  0. 999999  to  approximately  0.9 
when  a  reasonable  error  function  is  introduced.  This  error  function  is  based 
on  the  error  frequency  documented  in  Reference  17.  Surely,  this 
amount  of  error  associated  with  Just  one  of  the  eight  functions  shewn  on 
Figure  IS  as  affecting  the  Calculated  Component  Probability  of  Failure  must 
increase  as  error  probabilities  are  introduced  for  the  other  functions. 
Although  no  proof  is  given,  Figure  2  of  Reference  4  shews  qualitatively  the 
alow  growth  in  reliability  as  various  tests  are  completed  and  the  magnitudes 
of  the  calculation  errors  are  reduced.  The  conclusion  must  be  drawn  that  the 
Analytical  Design  Stage  of  the  Purely  Statistical  Structural  Reliability 
System,  even  as  the  comparable  stage  in  the  Present  System,  is  not  by  itself 
sufficiently  accurate  to  serve  aa  the  measure  of  the  Actual  State  of  the 
Structural  System. 

(2)  Strength  Test  Stage 

A  functional  outline  of  the  Strength  Test  Stage  of  the  ASIS  in  the 
Purely  Statistical  Structural  Reliability  System  is  shown  on  Figure  19. 


This  outline  effectively  exposes  an  Jj^>ortant  consideration 
that  undoubtedly  has  been  a  major  factor  in  the  reluctance  of  experienced 
engineers  to  embrace  the  structural  reliability  approach  in  designing 
structural  systems.  This  consideration  has  been  overlooked  by  most  proponents 
of  structural  reliability  procedures. 

The  problem  is  that  the  Strength  Test  as  presently  constituted  does  not 
result  in  any  direct  indication  of  the  Actual  State  of  the  Structural  System. 

If  the  Desired  State  is  going  to  be  defined  in  statistical  terms,  so  also 
must  the  Actual  State.  A  single  Strength  Test  has  no  particular  value  as  an 
indicator  of  the  structural  reliability  or  component  probability  of  failure. 

As  noted  in  the  Evaluation  of  the  Present  System,  the  Strength  Test  serves 
as  the  final  arbiter  of  the  true  M.S.  of  the  Structural  System.  A  correspond¬ 
ing  capability  simply  does  not  exist  for  ths  tsst  operation  in  a  Structural 
Reliability  System.  Any  feasible  test  procedure  where  one  or  two  test 
articles  are  tested  for  a  limited  number  of  discrete  conditions  could  not 
possibly  delineate  ths  statistical  parameters  associated  with  the  structural 
system  under  investigation  As  Gross  says  in  Reference  26,  "funding  of  test 
programs  to  prove  reliability  numbers  like  0.99999  would  bankrupt  the  nation." 

He  points  out  that  we  "desire  something  (accurate  numbers)  which  is  economically 
unobtainable." 

Coutinho  and  Tiger  make  so ue  pertinent  observations  in  Reference  16 
that  are  applicable  to  the  structural  reliability  problem.  They  state  that 
"the  quantification  of  reliability. . .is  a  necessary  prerequisite  for 
expressing  (it)  as  (a)  contract  requirement  and  as  a  condition  of  hardware 
acceptance.  Such  quantified  requirements  must  be  expressed  in  terms  that 
can  be  demonstrated  in  qualification  and  acceptance  tests....  The  objective 
of  the  reliability  prediction  during  ths  conceptual  stage  is  to  Justify  the 
selection  of  a  design  which  will  meet  the  reliability  qualification  tests." 

In  the  Present  System  the  successful  support  of  the  Ultimata  Design 
Load  constitutes  a  very  practical  means  for  defining  proof  of  compliance  that 
leads  to  hardware  acceptance.  A  Purely  Statistical  Structural  Reliability 
System  is  deficient  in  this  respect. 

Incidentally,  the  ability  to  focus  attention  on  the  true  objectives  of 
a  structural  design  system  and  the  function  of  various  procedures  in  that 
system  demonstrates  the  power  of  the  informetics  concept  in  evaluating 
the  various  approaches. 

The  previous  section  documented  the  fact  that  analytical  procedures 
Alone  are  not  accurate  enough  to  determine  the  reliability  of  a  structural 
nyatem.  The  present  section  indicates  that  the  typical  Strength  Test  will 
not  add  significantly  to  the  definition  of  the  Actual  State. 

There  are  other  problem  areas  in  the  determination  of  the  statistics  on 
the  loads  and  the  operational  conditions.  All  things  considered,  the  Purely 
Statistical  Structural  Reliability  System  is  not  a  practical  system  unless 
some  way  can  be  devised  to  demonstrate  that  the  structure  complies  with  the 
contractual  requirements.  Without  this  capability  it  is  not  feasible  to 
write  a  definitive  contract  for  the  design,  fabrication  and  construction  of 
an  aerospace  vehicle. 


i 
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(3)  Plight  Test  Stag* 

A  functional  outline  of  the  Flight  Test  Stage  of  the  ASIS  in  the  Purely 
Statistical  Structural  Reliability  System  is  shewn  on  Figure  20.  The  function 
of  the  Flight  Test  is  comparable  to  that  of  the  Strength  Test.  The  results 
of  the  Flight  Test  can  only  define  necessary  revisions  in  the  loula  analysis. 
This,  in  turn,  may  revise  the  calculation  of  the  loads  spectra  and  the  calcu¬ 
lation  of  probability  of  failure.  The  Flight  Teat  does  not  and  cannot  produce 
information  that  directly  affects  the  determination  of  the  Actual  State.  The 
transfer  function  that  determines  the  local  loads  for  a  given  operational 
condition  can  be  validated.  The  loads  spectra  are  still  collet ely  dependent 
on  the  frequency  of  occurrence  of  the  various  operational  conditions.  The 
Flight  Test  Stage  can  contribute  very  little  to  the  statistics  of  the  load 
spectra.  Even  if  statistical  data  on  loads  are  collected  during  the  Flight 
Test  Stage,  they  are  not  usually  applicable  to  the  normal  operational  usage 
of  the  vehicle.  It  is  virtually  impossible  to  generate  information  during 
flight  test  operations  that  will  lead  to  the  acceptance  or  rejection  of  a 
design  on  the  basis  of  compliance  with  a  structural  reliability  requirement . 

(4)  Operational  Failure  Stage 

A  functional  outline  of  the  Operational  Failure  Stage  of  the  ASIS  in 
the  Purely  Statistical  Structural  Reliability  System  is  shorn  on  Figure  21. 

The  function  of  the  ASIS  in  the  Purely  Statistical  design  system  is  markedly 
different  than  the  corresponding  stage  of  the  Present  System.  It  is  pointed 
out  in  the  discussion  of  the  Operational  Failure  Stage  of  the  Present  System 
in  Section  II  that  one  of  the  most  important  uses  of  failure  information  is 
in  the  determination  of  the  probable  cause  of  the  failure.  Establishing  a 
cause  of  failure  is  obviously  the  first  step  in  management  action  to  prevent 
such  i\  situation  from  reoccurring. 

In  the  Purely  Statistical  Structural  Reliability  System  it  is  impossible 
to  designate  a  cause  and  to  pinpoint  the  responsibility.  Cause  and  responsi¬ 
bility  are  determiniotic  concepts.  They  are  incompatible  with  the  concept  of 
randomness  that  underlies  the  Purely  Statistical  approach.  If  a  situation 
occurs  that  was  predicted  to  occur  only  once  in  a  million  times,  the  parties 
concerned  can  claim  that  the  occurrence  was  a  random  manifestation  of  something 
that  is  to  be  "expected"  occasionally.  If  the  situation  repeated  itself,  it 
could  still  be  claimed  to  be  a  random  situation  even  though  it  is  nc*  a 
one-in-a-trillion  situation.  In  a  Purely  Statistical  Structural  Reliability 
System,  there  is  no  mechanism  available  to  provide  the  basis  for  —Vjng  a 
firm  management  decision  that  something  is  wrong  and  should  be  corrected. 

Mathematically,  the  problem  outlined  on  Figure  21  is  that  the  Statistical 
Analysis  on  a  few  failures  and  many  non-failures  inherently  dose  not  provide 
much  meaningful  information  to  compare  with  the  Desired  State.  Any  numbers 
calculated  in  such  situations  will  have  such  wide  confidence  bands  that  they 
negate  any  meaningful  decisions.  It,. is  difficult  to  vlsualiee  what  has  been 
proved  about  Structural  Reliability  if  a, fleet  of  100  Airplanes,  rith  an 
expected  reliability  of  0.9999,  have  flown  for  one  half  of  their  .‘icheduled 
life  without  failure.  Even  if  the  true  reliability  of  the  fleet-  were  an 
order  of  magnitude  worse  than  desired,  there  would  be  only  one  chance  in 
twenty  of  a  failure  in  the  circumstances  described. 


The  problem  is  that  th*  limited  data  available  from  operational  results 
doea  net  contribute  significantly  to  the  capability  to  make  decisions  &a  to 
whether  or  not  the  structural  system  compl* as  with  the  requirements. 

c.  Evaluation  of  Structural  Reliability  System  Performance 

The  preceding  ew'-'&tion  of  the  Purely  Statistical  Structural 
Reliability  System  aa.  >s  clear  that  the  overriding  problem  impeding  the 
general  adoption  of  this  system  as  the  preferred  structural  design  system 
is  the  impossibility  of  accurately  determining  the  Actual  State  of  the 
Structural  Reliability  of  a  vehicle.  The  Desired  State  is  simple  to  define, 
although  more  care  than  is  typical  in  discussions  to  date  is  needed  to  define 
the  precise  meaning  of  the  Structural  Reliability  of  a  vehicle. 

A*  noted  in  the  previous  evaluation  on  page  63,  quantified  requirements 
must  be  expressed  in  terms  that  can  be  demonstrated  in  qualification  and 
acceptance  tests.  It  does  not  appear  that  a  Structural  Reliability  quantity 
can  possibly  be  demonstrated  in  a  reasonably  practical  procedure.  Analysis 
alone  has  been  pointed  out  as  being  too  inaccurate  to  serve  t s  the  demonstra¬ 
tion.  A  limited  quantity  of  strength  test  articles  cannot  accurately  define 
the  Structural  Reliability  of  the  complete  operational  system.  Also,  there 
is  too  much  dependence  on  the  functions  of  many  other  systems  being  exactly 
as  predicted  for  the  strength  teat  to  be  definitive  of  the  S.R. 

Since  every  function  that  has  a  tearing  on  the  determination  of 
Structural  Reliability  has  a  finite  possibility  of  occurrence,  it  is 
impossible  to  designate  the  cause  of  any  failure  as  being  the  responsibility 
of  an  identifiable  individual  or  group.  There  does  not  appear  to  be  a 
reasonable  way  to  say  that  something  that  has  a  probability  of  exceedance 
of  O.Ol  is  acceptable  but  is  unacceptable  if  the  probability  of  exc  dance 
is  0.00001.  More  to  the  point,  it  is  not  possible  to  prove  which  situation 
represents  the  true  probability  after  only  one  failure. 

Statistical  data  on  structural  failures  and  successes  during  operational 
usage  of  the  vehicle  are  inevitably  insufficient  to  accurately  define  S.R. 
and  to  make  decisions.  Suppose  &  structural  failure  occurs  on  the  50th 
operational  vehicle.  The  required  S.R.  is  0.99999.  In  such  circumstances, 
how  can  a  rational  decision  be  made  or  whether  the  single  failure  is  proof 
that  th.  S.R.  is  less  than  required-  There  is  simply  no  way  to  decide 
whether  the  failure  is  the  rare  random  failure  of  a  system  whose  true  S.R. 
is  0.99999  or  whether  the  failure  is  the  expected  (50  percent  probability) 
failure  of  a  system  whose  S.R.  is  0.986. 

As  the  direct  result  of  the  impossibility  to  measure  tht  Structural 
Reliability  of  a  vehicle  system  with  sufficient  accuracy,  it  Is  not  feasible  to 
write  a  definitive  contract  requiring  demonstration  of  Structural  Reliability. 
Without  the  capability  to  be  placed  under  contract,  the  Purely  Statietlcal 
Structural  Reliability  System  is  not  a  workable  system. 
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3.5  SUMMARY  OF  EVALUATIONS 


The  evaluation  of  the  Present  (Factor  cf  Safety)  Structural  Design 
System  and  a  Purely  Statistical  Structural  Reliability  ^yotam  in  terms  of 
Professor  Draper's  informeti.es  concept  has  provided  an  unparallslsu 
opportunity  to  dispassionately  discuss  the  strong  points  and  wesknssssg  of 
each  system.  It  is  hoped  that  this  discussion  will  Illuminate  the  structural 
design  problem  as  it  has  never  been  done  before. 

The  evaluation  of  the  Present  System  has  disclosed  nothing  startlingly 
new.  The  Present  System  is  generally  very  satisfactory.  Structural  systems 
produced  in  accordance  with  the  dict&tea  of  the  Present  System  generally 
have  a  high  degree  of  structural  intsgrity.  The  Present  Structural  Design 
System  is  practical  to  use  for  design  purposes  and  easy  to  administer  for 
contract  purposes.  The  discussion  and  evaluation  In  Section*  II  and  III  have 
served  to  spotlight  many  of  the  reasons  why  the  Present  System  has  been  so 
successful.  More  important,  it  has  served  to  indicate  some  areas  that  may 
become  troublesome  in  the  future. 

The  evaluation  of  a  Purely  Statistical  Structural  Reliability  System 
has  disclosed  the  fundamental  reasons  why  the  concept  has  never  been 
extensively  adopted  for  structural  design  purposes.  The  evaluation  tends  to 
justify  the  average  engineer's  intuitive  rejection  of  a  structural  design 
system  in  which  a  structural  reliability  nuaber  is  the  b&eic  requirement. 

A  brief  summary  of  the  evaluation  fallows  together  with  reccomendations 
for  a  future  course  of  action. 

a.  Present  (Factor  of  Safety)  Strui  i  Design  System 

Use  of  the  Present  (Factor  of  Safety)  Structural  Design  System  generally 
produces  structural  systems  with  a  high  level  of  structural  integrity. 
Decisions  on  whether  or  not  &  particular  design  complies  with  the  requirements 
are  made  on  a  deterministic  basis.  Provision  for  proof  of  compliance  is 
inherent  in  the  Present  System.  Thus,  the  Present  System  is  very  practical 
and  easily  administrable. 

The  fundamental  problem  area  in  the  Present  System  resides  in  the  fact 
that  there  is  no  clearly  identifiable  objective  that  the  Present  System  is 
expected  to  satisfy.  The  requirements  have  evolved,  for  the  most  part,  as 
a  reaction  to  past  problems.  There  is  an  implicit  assumption  that  future 
structural  systems  will  have  the  same  characteristics  as  past  systems.  This 
is  not  necessarily  a  valid  assumption.  In  particular,  current  trends 
Indicate  that  many  future  systems  will  have  a  much  larger  coefficient  of 
variation  in  strength  than  has  been  customary  in  the  past.  Also,  most  space 
vehicles  will  not  receive  the  extensive  flight  loads  testing  that  has  been 
customary  with  aircraft.  Both  of  these  conditions  tend  to  degrade  the  power 
of  the  test  to  disclose  errors  in  the  analysis. 

Another  result  of  the  lack  of  a  clearly  identifiable  objective  ie  that 
there  is  no  logic  available  that  can  resolve  questions  such  as  a  request  to 
lower  the  factor  of  safety  from  1.5  to  1.4*  There  is  great  need  for  a 
criterion  by  which  to  Judge  such  questions  objectively. 
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In  soma  of  the  newer  structural  design  areas,  such  as  fatigue  and  high 
tampered  urea,  th<»  factor  of  safety  concept  is  not  directly  applicable  to  the 
definition  of  structural  design  requirement*.  There  is  even  mors  need  to 
clearly  define  the  objectives  of  the  structural  deeign  system  for  these 
problems  than  there  ia  for  the  probleais  that  the  Present  System  conventionally 
considers*  Coupled  with  the  definition  of  an  objective  must  bv  practical 
procedures  for  determining  the  Actual  State  and  for  proof  of  compliance 
with  the  stated  objectives. 

In  situations  where  a  structural  failure  does  occur,  the  deterministic 
nature  of  the  Present  System  permits  the  determination  of  a  cause  of  failure, 
impossibility  for  the  failure,  and  corrective  action.  However,  many  of  the 
interfaces  between  the  structural  system  and  other  systems  are  not  explicitly 
defined.  Therefore,  responsibility  for  some  of  the  areas  contributing  to 
structural  Integrity  is  not  recognised  until  after  a  failure  occurs. 

b.  Purely  Statistical  Structural  Reliability  System 

The  principal  deterrent  to  the  adoption  of  a  Purely  Statistical 
Structural  Reliability  System  is  the  fact  that  there  is  no  procedure  for 
accurately  determining  the  actual  structural  reliability  of  a  particular 
structural  design.  As  a  result,  there  is  no  proof  of  compliance  technique 
that  would  be  satisfactory  for  demonstration  that  a  contractual  requirement 
has  been  fulfilled. 

As  a  derivative  of  the  problem  of  determining  the  value  representing  the 
actual  structural  reliability  of  a  vehicle,  there  is  the  problem  of 
detensiniag  a  cause  and  aseiicning  responsibility  when  structural  failures  do 
occur.  When  cause  and  responsibility  are  not  determinable,  neither  is  the 
corrective  action. 

e.  General  Evaluation 

The  Present  (Factor  of  Safety)  Structural  Design  System  is  a  generally 
satisfactory  system  for  the  design  of  aerospace  vehicles.  However,  there 
are  some  problem  areas  that  will  become  more  apparent  as  advanced  missions 
require  the  use  of  new  structural  configurations  and  materials.  A  Purely 
Statistical  Structural  Reliability  System  is  not  practical  for  the  deeign 
of  aerospace  vehicles.  Since  there  is  no  way  to  accurately  measure  structural 
reliability,  it  ia  not  possible  to  write  a  definitive  contract  requiring 
demonstration  of  a  specified  structural  reliability. 

3.6  RSCGMQHDED  CHARACTERISTICS  FOR  A  STRUCTURAL  r.3SIGN  SYSTEM 

It  is  reccssmnded  that  the  development  of  a  new  structural  design 
system  be  implemented.  This  new  system  should  incorporate  the  desirable 
features  of  the  Present  System  but  with  modifications  that  would  overcome 
the  problems  dismissed  in  this  report.  It  appears  that  the  state  of  the  art 
is  sufficient  to  develop  such  modifications  at  tha  present  time. 

The  modifications  of  the  Present  System  should  include  the  following 
characteristics : 
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1.  Retain  the  deterministic  type  of  requirement*  that  give  the 
present  system  its  practicality  and  adminl strablllty. 

2.  Establish  a  clearly  identifiable  objective  that  «culd  serve  aa 
a  basis  for  Judging  any  proposed  modification  to  the  Present 
System. 

3.  Incorporate  a  structural  reliability  goal  aa  part  of  th^ 
objective.  The  goal  should  not  become  a  requirement  aince 
structural  reliability,  per  ee,  cannot  bo  determined 
accurately  enough  to  serve  aa  a  contractual  requirement. 

4.  Develop  the  techniques  to  convert  the  structural  reliability 
goal  into  deterministic  requirements  based  on  statistical 
considerations. 

5.  Add  to  the  Present  System  the  capability  to  deal  with 
structural  systems  having  large  strength  scatters. 

6.  Integrate  specific  problems  such  as  fatigue  and  high 
temperature  design  into  the  total  structural  design  system 
to  attain  the  defined  objective. 

7*  Identify  explicitly  the  crucial  interfaces  with  non- 

structural  systems.  Make  provision  for  assigning  responsi¬ 
bility  for  every  function  that  affects  structural  integrity. 

8.  Utilize  the  concept  of  testing  as  a  disoloser  of  error  in 
formulating  design  requirements. 

9.  Expand  the  analysis  and  understanding  of  structural  design 
systems  beyond  the  scope  of  the  present  report  in  order  to 
develop  a  more  rational  basis  for  the  necessary  modifications 
to  the  Present  System. 
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SECTION  IV 


A  CRITIQUE  CP  CURRENT  APPROACHES 


A. I  INTRODUCTION 

The  eralaatiuH  of  existing  procedure a  play a  *  vital  part  in  furthering 
the  development  of  quantitative  structural  design  criteria  by  statistical 
Methods.  Any  critique  of  the  available  procedure*  ah cold  be  based  ce  an 
understanding  of  the  purpose  of  structural  design  criteria.  Such  an  under¬ 
standing  of  purpose  ie  eetabliahed  in  Section  II  to  bm*  the  cbjsctiTss  for 
this  investigation.  An  ©valuation  of  the  two  basic  systsas  is  presented  in 
Section  III. 

The  evaluation  of  the  two  basic  aysteaa  la  extended  in  Section  IV  to 
Include  a  critique  of  a  group  of  papers  concerned  with  the  question  of 
structural  dasign  and  structural  reliability.  The  papers  selected  are 
considered  to  be  a  representative  cross  section  of  the  Methods  extant  in  the 
technical  literature.  The  critique  of  the  individual  paper')  ie  based  on  a 
comparison  with  the  two  basic  systeas  evaluated  in  Section  111  with  additional 
analysis  appropriate  to  the  particular  procedure  being  discussed.  None  of  the 
papers  selected  represent  Methods  developed  to  fulfill  the  functions  of  s 
structural  design  systea  as  established  in  Section  II.  Therefore,  any  failure 
to  consider  these  functions  Is  no  reflection  cn  the  papers  or  the  authors. 

The  intent  of  this  investigation  ia  to  davalop  a  procedure  to  fulfill  the 
structural  design  ayetaa  functions  described  In  Section  II,  utilising  the 
applicable  feature*  of  existing  Methods  to  the  fullest  extant  possible.  The 
ccnparative  critique  will  allow  ■—•■H—m  possible  applications  of  past 
experience. 

4.2  BASIS  FOR  CRITIQUE 

Structural  design  criteria  is  one  of  the  elaaanta  in  a  structural  design 
systea.  A  structural  dasign  syatsa  is  defined  broadly  as  everything  that  has 
an  interface  with  the  structural  systea  (eoaacnly  called  the  airfraat  or  the 
hardware),  end  everything  that  has  a  bearing  on  whether  the  structure  survives 
or  not,  as  discussed  in  Section  3*2. 

The  fundsaottal  purpose  of  any  structural  design  systea  ie  the  creation 
of  an  operational  structural  systea  that  will  arable  the  vehicle  to 
satisfactorily  perform  its  Mission.  The  desired  structure  does  not  sliqply 
occur.  It  is  the  result  of  aany  ■snagaunt.  decisions  that  trigger  actions  in 
aany  processes  leading  to  the  final  product.  The  basis  for  evaluating  any 
structural  design  systea  Must  be  the  consideration  of  how  effectively 
decisions  are  Made  and  lapl eaanted. 

Figure  10  preeaots  s  functional  diagram  showing  thi  alsaarts  of  a 
structural  design  systea.  As  this  figure  shows  and  aa  discussed  In  Sections 
II  end  I1I6  the  basis  for  these  asnsgsasnt  decisions  aast  be  the  determination 
of  the  Actual  State.  Hence,  the  evaluation  benoame  largely  on  evaluation  of 
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the  Dealrvd  State  Information  System  (DSIS)  and  the  Actual  State  Information 
System  (ASIS) ,  It  is  assumed  that,  If  the  correct  information  is  presented 
to  the  management ,  the  correct  decision  will  be  forthcoming. 

Coutinho  and  Tiger  hare  expressed  the  seas  thought  recently  although  not 
with  the  formality  of  Profeasor  Draper's  system.  They  atated  in  Reference  16 
that  "The  quantification  of  reliability  and  other  ayataa  effectiveness 
parameters  Is  a  necessary  prerequisite  for  expressing  them  as  contract  require¬ 
ment*  and  as  conditions  of  hardware  acceptance.  Such  quantified  requirements 
must  be  expressed  in  terms  that  can  be  demonstrated  in  qualification  and 
acceptance  tests  which  must  be  run  prior  to  acceptance  and  payment."  They 
also  make  the  very  pertinent  observation  that  the  "objective  of  reliability 
prediction  is  not  prediction  per  se,  but  rather  useful  prediction." 

Coutinho  and  Tiger  go  on  to  present  an  exposition  par  excellence  of 
the  Fundamentals  of  (Reliability)  Prediction  Techniques.  This  discourse 
is  ao  relevant  to  the  structural  reliability  problem  that  it  is  reproduced 
verbatim. 

"Certain  rituals  from  time  to  time  become  so  well  entrenched  that  they 
can  no  longer  be  evaluated  objectively  by  their  practitioners.  It  is  a 
case  of  not  seeing  the  forest  because  of  all  the  trees.  Sons  of  this 
has  occurred  in  reliability  prediction.  In  order  to  introduce  a  measure 
of  objectivity,  it  appears  desirable  to  review  briefly  the  fundamentals 
of  engineering  prediction  techniques. 

“Formal  technical  prediction  always  is  based  on  a  generalisation  of 
past  experience,  the  generalisation  being  expressed  as  a  'model. '  To 
design  a  model,  the  significant  parameters  which  capture  the  essence  of 
past  experience  are  expressed  in  quantitative  terms  (measured  i  bservations ) . 
These  values  are  arranged  in  bobs  meaningful  orderly  fashion  so  that  their 
relationship  to  one  another  becomes  comprehensible.  Within  the  limits  of 
the  observations ,  these  relationships  are  usually  defined  in  a  mathematical 
formula  which  constitutes  the  'model'  with  which  the  future  can  be  predicted 
within  the  stated  limits.  The  validity  of  any  model  or  analytical  method 
is  established  by  it#  ability  to  predict  an  event  before  it  occurs. 

“The  successful  application  of  these  principles  requires  the  use  of 
a  mmfeer  of  ingenious  tricks.  The  first  one  is  to  select  the  significant 
parameters,  that  is,  the  ones  which  correlate  positively  with  the 
occurrence  of  the  event  to  be  predicted.  Furthermore,  from  a  practical 
engineering  viewpoint,  the  parameters  should  be  easy  to  define  and  to 
■assure.  Lastly,  there  must  be  a  system  of  timely  and  simple  tests  to 
confirm  the  predictions.  The  shorter  the  elapsed  time  between  prediction 
and  verification,  the  greater  the  pressure  for  accuracy  in  the  prediction. 

The  earlier  in  the  design  cycle  that  the  information  becomes  available, 
the  sere  useful  it  will  be. 

"In  a  complex  development  program  the  tests  must  be  completed  at  a 
*Amm  when  the  design  can  still  be  modified  if  the  validity  of  the  prediction 
Is  not  sustalhsd.  In  oases  where  the  validity  of  a  prediction  procedure 
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has  been  generally  recognised  over  a  long  period  of  tine,  11  nay  be 
acceptable  to  restrict  par4/  of  the  testing  program  to  testing  the  validity 
of  the  design  assumptions. 

"These  principles  are  not  easy  to  apply j  in  fact,  their  application 
requires  considerable  creativity.  Within  this  fri raevork  it  is  well  to 
r-ssdscr  that  the  wore  'engineer'  originally  denoted  cane  skilled  in  the 
application  of  'engine*  or  'ingenuity.'  Engineering  is  the  art  of  skillful 
approximations,  and  a  rough  measurement  of  the  right  parameters  is 
infinitely  acre  meaningful  than  a  precise  measurement  of  the  wrong  dimensions  * 

4.3  STANDARDS  Of  S7AUJATT0H 

Three  considerations  ware  presented  in  Section  3 .2  as  the  basis  for 
evaluating  the  two  basic  structural  design  system*.  The  evaluation  of  the 
individual  papers  selected  as  the  subjects  for  the  critique  in  this  section 
will  follow  these  saue  standards.  The  three  coned. derations  are  as  follows; 

a.  How  effectively  does  the  structural  design  system  define  the 
De aired  State? 

b.  How  accurately  can  the  Actual  State  of  the  structural  system 
be  determined? 

e.  How  early  in  the  design  and  deployment  cycle  of  the  operational 
system  will  any  discrepancies  between  the  Desired  State  and 
Actual  State  be  disclosed? 

4.4  INDIVIDUAL  CRITIQUES 

All  but  on*  of  the  papers  critiqued  fall  in  the  class  of  a  Purely 
Statistical  Structural  Reliability  System.  The  exception  is  a  modification 
of  the  Present  (Factor  of  Safety)  Structural  Design  System.  In  general,  the 
evaluations  developed  in  Section  III  for  the  two  basic  system*  are  applicable 
to  the  papers  considered  in  this  section.  However,  the  general  evaluations 
ere  extended  and  a  detailed  discussion  is  presented  for  each  paper, 
separately.  In  earns  cases,  particular  cosmmnts  are  valid  for  more  than  on* 
paper.  Such  comm ante  are  not  repeated,  but  the  discussion  of  one  paper  is 
referenced  in  the  discussion  of  the  second  paper  with  no  implication  that 
the  count  is  any  more  valid  for  the  first  paper  than  for  the  second. 

a.  Purely  Statistical  Structural  Reliability  Methods 
(l)  Huger 

In  Reference  11,  Kluger  presents  a  brief,  clear  exposition  of  the 
approach  designated  in  Section  II  as  the  Purely  Statistical  Structural 
Reliability  System.  In  the  Reference  11  paper  the  procedure  is  developed 
as  a  technique  "for  predicting  the  &  priori,  design  of  a  large  solid- rocket 
motor.  It  Is  postulated  that  the  motor  reliability  ^  it  a  function  of  its 
structural  reliability  R,  and  its  performance  reliability  R-.  The  structural 
reliability,  which  also  can  be  termed  the  probability  that  the  structure  will 
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successfully  retain  the  motive  elemmits  for  the  intended  dnraticn  within  the 
envircnmsntal  envelope,  Is  coepzted  using  'the  distributions  of  mivironmwital 
strsssos  and  material  strengths."  Most  of  tho  pspsr  is  dsTOtsd  to  tho  calcu¬ 
lation  of  structural  reliability. 

As  noted  in  Section  4-3,  the  first  consideration  for  evaluation  is:  How 
effectively  does  the  structural  design  systata  define  the  Desired  State?  In 
Section  III  it  is  pointed  out  how  si^ls  it  is  to  establish  a  structural 
design  systesi  where  the  Desired  State  is  represented  by  s  structural 
reliability  number.  Anyone  can  choose  a  desired  structural  reliability 
number  from  soro  to  one,  with  or  without  an  explanation  of  the  basis  for  the 
choice.  The  problem  is  somewhat  more  difficult  if  the  choice  is  to  be  aade 
on  a  rational  basis.  However,  it  is  not  anticipated  that  this  problem 
offers  any  insurmountable  difficulty  to  design  Management,  possessing  the 
appropriate  background  and  experience. 

Kluger  suggested  one  basis  for  the  choice  in  his  discussion  of  structural 
reliability  tradeoffs.  However,  it  is  difficult  to  see  how  tradeoffs  could 
be  considered  in  structural  design  criteria.  In  a  competitive  procurement 
situation,  a  acini  mm  requirement  is  established  and  all  bidders  are  required 
to  equal  or  exceed  the  mini  mum.  -It  does  not  appear  realistic  to  consider 
that  one  contractor  could  be  permitted  to  supply  a  less  reliable  system 
simply  because  the  cost  of  meeting  the  mini  mm  reliability  requirement  was 
higher  than  desired.  Ota  the  other  hand,  ths  contracting  agency  might 
establish  the  level  of  reliability  required  on  the  basis  of  tradeoff  studies. 
Ctace  established  the  specific  nuaber  chosen  would  become  the  requirement. 

The  reliability  nuabers  used  in  the  examples  and  the  range  of  the  failure 
probabilities  shorn  on  the  figures  of  Reference  11  are  considered  reasonable 
and  are  consistent  with  other  suggested  structural  reliabilities. 5 

Cfce  problem  that  Reference  11  did  not  consider  is  the  question  of  the 
precise  meaning  of  structural  rail  ability.  Section  3 -4  noted  that  there 
are  three  orders  of  reliability.  These  are  the  reliabilities  for  an 
individual  vehicle,  thooe  for  the  group  of  nominally  identical  vehicles  of 
a  particular  design,  end  the  general  reliability  of  all  vehicles  of  all 
designs  resulting  from  following  the  precepts  of  a  particular  design  system. 
Kluger  apparently  considers  only  the  second  type  of  reliability,  that  of  the 
group  of  vehicles  of  one  particular  design.  Such  a  choice  involves  the 
implication  that  it  is  acceptable  (desired)  that  one  or  more  vehicles  in  a 
group  nay  have  individual  reliabilities  that  are  so  low  that  failure 
approaches  a  certainty.  This  would  be  possible  if  the  reliabilities  of  the 
remainder  of  the  vehicles  were  sufficiently  high.  This  is  analogous  to  the 
famous  story  of  the  statistician  who  drowned  crossing  a  river  averaging  three 
feet  deep.  To  rsoogni.se  that  an  individual  structure  in  a  group  of 
similar  structures  may  occasionally  fail  Is  being  realistic.  But  to  convert 
this  recognition  int  o  permissiveness  by  establishing  that  a  certain  znufcer 
of  failures  is  acceptable  is  questionable.  Just  such  permissiveness  is 
established  if  a  requirement  such  as  a  structural  reliability  of  0.9999  is 
the  only  requirement  defined. 

The  cossaxi  assumption  characteristic  of  most  structural  reliability 
papers  is  that  a  structural  reliability  number  can  be  used  to  define  the 
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Desired  State  of  a  structural  system.  Although  the  definition  of  structural 
reliability  is  usually  somewhat  imprecise,  as  in  this  paper,  there  would  be 
no  great  difficulty  in  formulating  a  sufficiently  precise  requirement  for 
the  structural  reliability  of  a  structure.  The  principal  difficulty  with 
the  Reference  11  procedure  os  with  most  structural  reliability  procedures 
suggested  to  date  resides  in  the  answer  to  the  second  evaluation  question 
from  Section  4.3:  How  accurately  can  the  Actual  State  be  determined? 

The  most  important  problem  impeding  the  general  adoption  of  a  Purely 
Statistical  Structural  Reliability  System  is  the  impossibility  of  accurately 
determining  the  Actual  State  of  the  structural  reliability  of  a  vehicle. 
Section  III  discusses  many  of  the  reasons  why  the  actual  structural 
reliability  cannot  be  determined  accurately.  Reference  11  assumes  that  there 
is  no  accuracy  problem  by  assuming  that  the  calculation  or  prediction  of 
structural  reliability  is  the  same  thing  as  the  determination  of  structural 
reliability. 

As  Coutinho  and  Tigar^  point  out,  "In  tihe  eyes  of  the  analyst,  'to 
predict'  generally  means  'to  determine."*  Nothing  could  be  further  from  the 
truth.  In  effect,  Kluger  and  others  assume  that  the  load  and  strength 
distributions  are  "known"  in  which  case  the  structural  reliability  is 
"known.1'  but  the  load  and  strength  distributions  are  not  known  simply 
because  a  particular  analysis  predicts  a  particular  distribution. 

Reference  17  documents  soma  of  the  errors  that  have  been  made  in  strength 
analysis  in  the  past.  Statistics  are  presented  on  the  frequency  of  various 
amounts  of  understrength  as  revealed  by  static  tests.  Theso  data  have  bean 
used  to  show  the  decrement  in  structural  reliability  due  to  the  incidence  of 
analytical  errors.*  Results  of  such  calculations  indicate  that  a  theoretical 
(no  error)  prediction  of  0.99999T  is  reduced  to  approximately  0.9  when  a 
reasonable  error  function  is  introduced.  A  comparable  situation  is  shown  on 
Figure  23  of  this  report  where  a  "no-error"  calculation  of  about  0.999  to 
0.9999  for  structural  reliability  deteriorates  to  about  0.9  when  the  error 
function  is  introduced.  It  i»  a  simple  truth  that  failures  have  occurred 
far  more  often  in  the  past  from  errors  of  omission  or  conmission  in  various 
loads  and  strength  analyses  than  from  a  random  variation  in  these  functions. 
Any  attempt  at  calculating  the  true  structural  reliability  without  consider¬ 
ing  the  statistical  distribution  of  analytical  errors  is  an  exercise  in 
futility.  Such  things  as  error  functions  may  not  be  recognized  but  they 
undoubtedly  contribute  to  the  reasons  why  mist  structural  engineers 
intuitively  reject  a  structural  reliability  number  as  the  basic  requirement 
for  design. 

This  omission  of  any  consideration  of  the  possibility  of  errors  in  the 
prediction  of  the  load  and  strength  distributions  is  the  principal  short¬ 
coming  of  the  Reference  11  procedure.  A  few  detail  comments  on  other 
aspects  of  this  paper  follow.  The  paper  correctly  evaluates  the  problem  of 
demonstrating  structural  reliability.  It  states  that  "The  statistical 
demonstration  of  reliability  with  the  customary  confidence  limits  (90-95/0 
requires  large  sample  sizes,  even  for  moderate  values  of  reliability  target 
values."  Then,  it  is  noted  that  "The  limitations  of  time  and  cost  obviously 
prohibit  such  test  programs."  The  discussion  in  Section  III  reinforces  the 
contention  that  demonstration  of  structural  reliability,  per  se,  is  not 
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feasible.  The  impossibility  of  demonstrating  structural  reliability  coupled 
with  the  typical  inaccuracy  in  calculating  a  structural  reliability  number 
means  that  a  Purely  Statistical  Structural  Reliability  system  such  as  Kluger 
advocates  is  not  practical  for  the  design  of  aerospace  vehicles. 

In  the  section  on  "Assessment  of  the  Structural  Reliability  Rj," 

Reference  11  states  two  Assumptions  that  define  the  basis  for  his  procedure. 
The  first  is  that  "it  ! ;  assumed  that  there  are  no  unknown  critical  modes  of 
failure."  The  second  is  that  "calculation  of  structural  reliability  is  based 
on  the  assumption  that  the  failure- causing  stress  function  and  the  material- 
resisting  function  are  both  representable  by  normal  distributions  with  known 
means  x  and  variances  of  a  2. " 

The  assumption  that  there  are  no  unknown  critical  modes  of  failure  is 
not  consistent  with  known  facts.  The  history  of  aerospace  design  from  the 
days  of  the  Wright  brothers  to  the  most  modern  spacecraft  is  replete  with 
examples  of  failure  modes  that  were  unknown  —  at  least  to  the  designer  — 
until  the  instant  the  failure  occurred.  Rhode2?  documented  several  cases 
where  space  vehicle  structures  failed  unexpectedly.  It  is  unlikely  that 
there  have  been  more  than  10,000  different  designs  since  the  Wright  brothers. 
It  is  certain  that  there  have  been  at  least  100  unexpected  failures  in  static 
test  or  in  operations.  Therefore,  it  is  inconceivable  that  the  actual 
structural  reliability  of  any  given  design  could  be  considered  to  be  greater 
than  0.99  when  based  on  analysis  alone  (no  test).  High  structural  reliability 
is  developed  in  the  real  design  situation  only  by  a  combination  of  analysis 
and  verification  as  described  in  Section  II. 

» 

The  assumption  that  the  load  and  strength  distribution  situations  are 
known  to  a  degree  of  accuracy  compatible  with  the  expected  structure 
reliability  cannot  be  substantiated.  The  previous  discussion  made  this 
clear.  The  principal  reason  that  these  unexpected  failures  occurred  Is  that 
the  mean  strength  or  the  mean  load  were  not  as  predicted.  A  minor  indictment 
of  the  assumption  is  the  obvious  inpossibility  of  a  normal  or  Gaussian 
distribution  as  a  true  representation  of  strength.  A  normal  distribution, 
by  definition,  has  non-zero  values  from  negative  infinity  to  positive 
infinity.  >  Intrinsically,  no  structure  can  have  a  strength  less  than  zero. 
Accordingly,  the  distribution  function  below  ,zero  strength  must  have  a  zero 
value.  Since  this  is  not  compatible  with  the  non-zero  value  of  the  normal 
distribution,  the  Gaussian  assumption  oust  be  wrong  over  the  half  of  the 
total  range  that  lies  between  negative  infinity  and  zero.  It  is  true  that 
the  assumption  of  normal  distribution  is  often  a  good  approximation,  of  the 
true  distribution.  However,  as  soon  as  the  choice  of  a  distribution  is 
recognized  as  an  approximation,  the  assumption  tha',  the  distribution  is  known 
becomes  unsatisfactory.  The  degree  of  approximation  or  the  error  between 
assumption  and  true  value  becomes  an  important  and  often  overriding  considera¬ 
tion  in  the  calculation  of  structural  reliability. 

toother  problem  in  diLerndnin^  the  characteristics  of  the  load  and 
strength  distribution  is  that  most  of  the  available  data  will  be  centered 
near  the  mean  value.  Experience  has  shown  that  any  one  of  a  number  of 
distribution  types  (such  as  normal,  log-normal  or  Weibull)  could  be  chosen 
with  essentially  the  same  degree  of  confidence  in  the  validity  of  the  choice. 


-  80  - 


Yet,  at  the  tails  of  the  curves  which  are  largely  instrumental  in  determining 
the  "no-error11  structural  reliability,  the  various  distributions  may  be 
orders  of  magnitude  apart.  The  approach  of  Reference  11  does  not  offer  much 
hope  for  coping  with  this  problem. 

Another  question  arises  in  connection  with  the  definition  of  the  strength 
distribution.  The  discussion  presented  in  Reference  11  is  concerned 
exclusively  with  applied  tensile  stresses  and  the  variation  in  the  stress 
at  which  the  material  fails.  There  are  many  modes  of  failure  in  which  the 
ultimate  tensile  stress  plays  a  minor  role.  Stability  failure  is  one 
example.  However,  even  the  simplified  case  given  in  the  paper  illustrates 
clearly  some  of  the  problems  in  the  Purely  Statistical  Structural  Reliability 
System.  The  "guaranteed"  strength  of  a  material  is  not  a  statistical 
property.  Even  though  some  materials  properties  presented  in  documents  such 
as  MIL-HDBK-5  are  ostensibly  statistically  determined,  in  actual  fact  all 
material  allowables  are  decided  by  committee  action.  The  accepted  values 
may  or  may  not  coincide  with  the  values  ascertained  by  any  given  material 
producer. 

In  any  event,  a  "guaranteed"  value  doesn't  guarantee  survival  of  a 
particular  vehicle.  If  the  material  should  happen  to  be  provably  under- 
strength,  the  supplier's  obligation  would  be  very  limited.  Topically,  the 
supplier  would  replace  a  few  dollars  worth  of  material  but  would  assume  no 
obligation  beyond  that  for  the  loss  of  a  multi-million  dollar  vehicle. 

Beyond  that  consideration,  an  allowable  tensile  stress  of  215  kips  would  not 
be  guaranteed  by  the  supplier.  Such  a  high  strength  in  steel  is  usually 
developed  by  heat  treating.  Since  this  is  a  user  process,  it  is  not  con¬ 
trolled  by  the  material  producer  and  cannot  be  guaranteed.  There  will  be 
variations  in  the  heat-treat  process  from  one  structure  to  the  next.  There 
will  be  variations  in  the  heat-treat  level  achieved  in  various  portions  of 
any  given  structure.  All  of  these  variations  add  to  the  variation  in  the 
basic  material  and  add  opportunity  for  error  in  the  fabrication  process. 

It  is  well  known  that  pressure  vessels  of  various  types  are  fabricated 
by  welding.  More  often  than  not,  the  weld  strength  is  the  critical  element 
in  the  structure.  There  have  been  authenticated  cases  where  the  weld 
strength  was  improperly  defined^  causing  a  premature  failure  of  the  pressure 
vessel.  There  are  other  cases  where  the  \(eld  strength  of  a  properly-made 
wold  was  correctly  defined  but  L ibrlcation  difficulties  resulted  in  an 
inferior  weld  after  a  large  number  of  vehicles  had  been  fabricated  with  the 
proper  welding  technique.  Both  of  these  situations  illustrate  that  the 
material  strength  distribution  does  not  necessarily  represent  the  strength 
distribution  of  the  structure. 

Just  as  the  true  strength  distribution  may  be  different  from  the 
predicted  distribution,  so  may  the  true  load  distribution  differ  from  the 
predicted.  The  choice  of  stress  as  the  parameter  describing  the  load 
function  illustrates  a  common  difficulty  in  defining  the  problem.  The  load 
for  the  example  case  is  the  pressure  in  a  rockot  motor  case.  The  basic 
question  is  whether  the  case  survives  or  fails  under  this  pressure.  Trans¬ 
forming  external  loads  to  internal  stresses  introduces  an  undesirable  step 
that  opors  the  way  to  solving  the  wrong  problem  in  the  analysis.  In  this 
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psrticula-  example,  it  is  assumed  that  membrane  (hoop)  failure  is  the 
principal  mod*  of  case  failure.  However,  it  is  well  known  thut  in  such 
situation#  the  failing  stress  is  affected  by  biaxial  stress  condi tions , 
discontinuities,  deviations  from  psrfsct  spherical  -end  closures,  etc.  It 
thus  bsccsrfis  impossible  to  prsaict  accurately  either  the  true  applied 
stresses  at  the  point  of  failure  or  the  streas  at  which  failure  will  occur. 

To  simplify  the  problem  to  the  extent  done  in  tnis  paper  is  to  render  the 
results  of  any  reliability  analysis  meaningless.  The  main  point  to  be  made 
here  is  not-  that  there  are  differences  between  the  simplified  analysis  of 
the  example  and  the  true  stress  distribution.  The  point  to  consider  is  that 
in  any  analyria  of  a  complex  structure  there  will,  be  such  difference 
between  predicted  (calculated)  and  true  values.  The  only  question  is  in  the 
magnitude  of  the  differences.  To  complicate  the  problem  further,  there  will 
be  differences  in  the  specific  values  calculated  by  one  analyst  when  compared 
to  those  calculated  by  another.  In  such  a  situation  it  is  impossible  to 
determine  the  truth.  Thus,  analya4s  alone  i3  vot  sufficient  as  the  modus 
operandi  to  determine  whether  or  not  a  structural  system  possesses  a  specified 
reliability. 

The  definition  of  factor  of  safety  ia  another  function  discussed  in  this 
papsr  that  should  t  examined  carefully.  (F.S.  ia  defined  as  the  ratio  of 
mean  strength  to  mean  load.)  A  definition  similar  tc  Kluger's  has  been  used 
by  other  authors.  Ths  question  is  more  fundamental  than  might  appear  from  a 
superficial  consideration .of  the  meaning  of  the  function.  First  of  all,  this 
definition  of  the  term  Factor  of  Safety  is  not  the  same  as  the  commonly 
understood  definition.  Certainly,  every  author  has  the  right  to  name  and 
define  his  own  terms.  However,  the  decision  to  change  the  meaning  of  a  term 
that  has  wide-spread  usage  and  understanding  while  associated  with  a 
different  meaning  is  unfortunate.  The  typical  aerospace  structural  engineer 
would  be  unnecessarily  confused  by  such  a  change.  Second,  some  of  the 
Implied  meanings  behind  the  present  usage  of  factor  of  safety  would  be  lost 
if  the  definition  were  adopted.  At  present,  most  engineers  would  consider 
that  the  factor  of  safety  represented  an  increment  in  load  beyond  the  limit 
load  that  the  structure  must  be  able  to  support.  It  could  be  shown  that,  in 
many  situations,  the  well-known  '  5  factor  of  safety  would  be  grossly 
insufficient  to  produce  a  reliab  .  structural  system  when  applied  to  the 
mean  load  as  recommended. 

The  factor  of  safety  also  represents  an  increment  in  structural 
capability  beyond  the  operational  conditions  that  are  designated  as 
operational  limitations.  Kluger!s  factor  of  safety  has  no  direct  relation¬ 
ship  to  ths  limit  loads.  As  a  matter  of  fact,  as  the  coefficient  of  strength 
variation  changed,  the  factor  of  safety  would  change.  It  would  be  quite 
confusing  to  operational  personnel  to  have  vehicles  operated  on  exactly  the 
same  mission  but  with  different  factors  of  safety  becrusa  the  structural 
conf igurat ’ cn  was  different.  This  might  be  .justifiable  if  it  were  the  only 
way  to  obtain  the  desired  results  from  a  structural  design  system.  Howovsr, 
it  can  be  shown  that  the  present  aseardng  of  the  factor  of  safety  can  be 
retained  while  introducing  statistical  concepts  into  structural  design 
procedures.  Thus,  there  is  really  no  reason  for  introducing  a  change  iu 
the  meaning  of  factor  of  safety. 
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In  tha  discussion  of  Performance  Reliability,  Reference  11  notes  that 
three  out  of  one  nundred  simulated  firing  showed  unacceptable  average  thrust 
and  total  in<pulse  valuos.  If  Just  one  of  these  three  unacceptable  firings 
happened  to  result  in  structural  failure  due  to  significant  excess  pressure 
during  operations,  the  failure  rate  would  approach  one-in-a-hundred  rather 
than  one-in-twenty- five-hundred  predicted  in  the  example.  If  such  a  failure 
occurred,  it  would  be  difficult  to  decide  whether  the  failure  resulted  from 
"unacceptable  average  thrust  and  total  impulse  values"  or  from  an  under- 
strength  structure.  If  the  first  situation  prevails,  it  means  that  the 
predicted  loading  distribution  is  not  the  true  distribution,  only  the 
distribution  conditioned  on  there  being  no  "errors"  in  operation.  If  the 
Utter  situation  prevails,  it  means  that  the  strength  situation  is  not  as 
predicted. 

This  simple  example  serves  to  illustrate  some  of  the  principal  problems 
involved  in  the  adoption  of  a  Purely  Statistical  Structural  Reliability 
System.  The  incidence  of  errors  in  the  calculation  of  the  actual  operational 
load  distribution  and  in  the  calculation  of  the  actual  strength  distribution 
simply  must  be  considered  to  obtain  a  realistic  reliability  figure.  From  the 
management  standpoint  there  is  no  way  to  define  the  cause  of  oho  failure  if 
the  firing  did  produce  unacceptable  thrust  because  there  is  no  defined 
limitation  on  what  is  acceptable  thrust,  fo  calculate  the  probability  of 
exceeding  a  given  thrust  imposes  on  no  raa  the  responsibility  for  avoiding  a 
tnrust  that  should  be  considered  to  br  an  overload.  If  a  cause  for  the 
failure  cannot  be  designated,  corrective  action  to  prevent  similar  failures 
cannot  be  taken. 

To  summarize  this  critique  of  Kluger's  proposed  procedure,  it  is 
concluded  that  the  aefinition  of  both  the  Actual  State  and  tha  Desired  State 
are  insufficient  for  use  ir  the  practical  design  of  aerospace  vehicles.  Some 
of  the  detail  considerati  ons  follow: 

1.  Lack  of  a  precise  definition  of  the  meaning  of  structural 
reliability  inhibits  use  of  the  parameter  as  a  design 
requirement. 

2.  Mo  basis  is  given  for  choice  of  a  particular  value  of 
structural  reliability  as  the  desired  value.  Tradeoffs 
between  structural  reliability  and  weight  and  cost  are 
not  realistic  03  tr.e  basi3  for  the  design  of  an  individual 
■/chicle. 

3.  The  assumption  is  made  that  load  and  strength  distributions 
are  "known."  Mo  consideration  is  giver,  to  the  possibility 
that  there  may  be  errors  ir.  the  varicus  analyses,  in  tr.e 
operation  of  the  vehicle,  and  in  the  fabrication  and  main¬ 
tenance  rf  the  structure.  As  -  result  the  theoretical 

cal. -ulation  of  structural  reliability  does  not  truly  reflect 
the  actual  r? liability. 
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4.  Testing  to  demonstrate  structural  reliability  is  repeated 
os  prohibitive  in  time  and  cost.  No  procedure  is  offered 
to  aerve  as  a  proof  of  compliance  with  a  structural 
requirement.  Without  such  a  procsdure  it  is  impossible 
to  write  a  definitive  contract  in  terms  cf  structural 
reliability. 

5.  Definition  of  the  factor  of  safety  as  the  ratio  between  the 
mean  strength  and  the  mean  load  is  a  gross  departure  from 
the  historical  meaning  of  the  term.  Inevitably,  such  a 
change  in  manning  will  result-  in  confusion  among  those 
concsmed  with  implementing  the  structural  design  and  with 
operating  the  resulting  vehicle. 

Evaluation  of  Kluger's  procedure  by  the  standards  listed  in  Section  4.3 
results  in  the  following  conclusions: 

1.  Reference  11  docs  net  define  which  of  the  three  types  of 
structural  reliability  is  being  specified  when  a  particular 
value  is  specified  as  the  Desired  State  r-f  the  structural 
system.  This  is  not  a  serious  problem  since  a  more  precise 
definition  of  what  is  meant  by  a  structural  reliability 
value  such  as  0.9999  would  not  be  difficult  to  add  without 
changing  the  basic  approach. 

2.  The  Actual  State  of  the  structural  system  cannot  be 
determined  very  accurately  by  the  proposed  procedure.  It 
depends  entirely  on  an  analytical  determination  of  failure 
modes,  failure  levels,  and  the  strength  and  load  distribu¬ 
tions.  It  can  bo  shown  that  determination  of  structural 
reliability  by  analysis  alone  ie  not  sufficiently  accurate 

_  for  the  lsvel  of  reliability  expected  in  most  structural 

design. 

3.  There  is  no  provision  in  the  procedure  for  the  disclosure 
of  discrepancies  between  the  Desired  State  and  Actual  State. 

Hence,  the  only  disclosure  will  be  as  a  result  of  An 
operational  failure.  Sven  after  a  failure  there  is  no 
mechanism  in  the  procsdure  for  deciding  whether  the  failure 
is  truly  the  random  failure  that  was  predicted  to  occur  in 
one-in-ten-thousand  vehicles  or  whether  the  failure  is  the 
direct  result  of  an  error  somewhere  in  the  design,  fabrica¬ 
tion,  inspection,  operation  or  maintenance  process. 

(2)  Hairs 

The  method  presented  by  Hairs  in  Reference  12  is  typical  of  his  rather 
extensive  writing  ar.d  analysis  on  the  subject  of  structural  reliability. 
Hairs' e  procedures  as  described  in  this  paper  are  very  comparable  to  those 
proposed  by  Kiuger.  The  first  four  considerations  listed  on  page  83  are 
equally  applicable  to  Reference  12. 


The  fifth  point  is  not  strictly  applicable  since  the  ratio_between  mean 
strength  and  mean  load  is  defined  as  the  "reliability  factor,  RF."  Although 
this  factor  has  exactly  the  same  meaning  as  Kluger's  factor  of  safety,  it 
does  not  have  the  disadvantage  of  changing  the  historical  meaning  of  the  term 
"factor  of  safety."  The  difficulty  in  using  Reliability  Factor  is  that  it 
is  not  a  physically  meaningful  term.  It  represents  an  abstract  concept.  The 
most  important  objection  to  the  adoption  of  a  Reliability  Factor  function  as 
defined  is  that  there  is  no  meaningful  correlation  between  the  Reliability 
Factor  (RF)  and_reliability.  There  is  a  question  whether  the  parameters 
entering  into  RF  are  known  with  an  accuracy  sufficient  to  justify  the_ 
Reliability  shown  on  Figure  3  of  Reference  12.  Aside  from  that,  an  RF  equal 
to  1.1  could  result  in  a  reliability  of  0.999999  while  an  RF  equal  to  2.6 
could  result  in  a  reliability  of  0.6.  It  all  depends  on  whether  the 
coefficient  of  variation  of  reliability  (CTO)  that  is  introduced  in  this 
analysis  is  large  or  small.  Haire's  Figure  3  shows  an  extremely  wide  range 
of  reliability  for  the  same  Reliability  Factor. 

Reference  12  states  that  "probability  distributions  cannot  be  accurately 
described  in  the  regions  of  extreme  values."  It  goes  on  to  say  that 
"Pre-established  levels  of  reliability  should  not  be  set  as  design  require¬ 
ments  but  only  as  design  goals."  Despite  these  acknowledged  limitations  in 
the  use  of  the  calculated  reliability  nunfeers,  Haire  proceeds  to  use 
reliability  numbers  approaching  0.999999  as  though  they  were  definitive. 

This  is  done  on  Figures  3  and  4»  Tor  example.  Oi  page  286,  it  is  stated 
that  "the  reliability  is  in  excess  of  0.99999."  With  the  data  available  and 
the  incidence  of  errors  described  in  Section  III,  it  is  unrealistic  to  say 
that  the  reliability  is  in  excess  of  0,99999.  Section  III  notes  that  the 
true  reliability  approximates  0.9  when  a  reasonable  error  function  is 
introduced  into  the  calculations.  If  this  be  ihe  case,  then  the  usage 
suggested  on  page  298  of  the  paper  becomes  dubious.  It  is  indicated  that  the 
analysis  showing  a  reliability  of  0.99994  for  the  first  stage  structure  and 
0.9997  for  the  interstage  structure  could  and  should  be  used  as  the  basis 
for  removing  weight  where  not  needed  and  adding  where  needed.  In  operation, 
the  stage  with  the  0.99994  reliability  that  is  presumably  over-strength  might 
fail  on  every  flight  because  of  some  miscalculation  in  arriving  at  the  loads 
or  strength.  On  the  other  hand  the  supposedly  less  reliable  interstage  might 
never  fail.  A  different  analyst  could  make  different  assumptions  (or 
different  mistakes)  resulting  in  the  opposite  decision  as  to  where  to  add  and 
subtract  weight.  When  such  a  circumstance  arises  (as  it  inevitably  will), 
this  approach  and  other  similar  approaches  offer  no  practical  procedures  for 
resolving  the  question  and  making  a  decision  as  to  which  analysis  is  correct. 

Reference  12  seemingly  reje'cts  testing  as  a  basic  element  in  the 
development  of  reliable  structures.  On  page  298  it  is  state'1  that  "Structural 
loads  and  strengths  must  be  described  and  related  by  statistical  methods... so 
that  only  minimum  reliance  need  be  placed  on  test  and  service  experience  to 
prove  designs."  The  logic  of  this  statement  is  questionable.  Inherently, 
the  description  of  loads  and  strengths  in  statistical  terms  has  no  relation 
to  the  need  for  a  test.  On  page  52  it  is  noted  that  the  true  function  of 
testing  is  to  act  as  an  error  discloser,  not  a  reliability  "prover."  It  has 
been  pointed  out  on  page  67  that  statistical  computations  are  "subject  to  all 
the  errors  in  the  loads  and  strength  analyses  of  discrete  condition"  plus  the 
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"occasional  errors  in  predicting  the  spectra  of  operational  conditione  and 
other  probabilities  contributing  to  the  calculation  of  probability  of 
failure." 

Formulating  the  analyses  in  the  sophisticated  techniques  of  the 
statistical  world  does  not  automatically  make  tha  calculations  error-free, 
thus  dl«lni ahiag  the  need  of  testing  as  a  procedure  to  disclose  these  errors. 
Coutinho  and  Tiger  express  the  realities  of  the  situation  very  eloquently  in 
Reference  16.  "Nor  Is  this  problem  of  confidence  in  the  validity  of  a 
"i** »i jiim* i "»i  wBvtui  necessarily  «e»ed  by  using  more  elegant  Bathejaatioe  or  a 
■ora  detailad  analytical  procedure.  Mathematics  is  truth  only  within  itself. 
We  Bast  always  aaka  assumptions  about  the  real  world  and  use  this  as  the 
starting  point  in  developing  a  mathematical  model.  Mathematical  truth  only 
pertain#  to  what  la  between  the  assumptions  and  the  developed  equations.  If 
the  assumptions  are  wrong,  the  resulting  equations  main  nothing  in  regard 
to  predicting  future  occurrences. " 

Evaluation  of  Haira's  procedure  by  the  standards  listed  in  Section  4*3 
results  in  essentially  the  same  conclusions  as  those  set  forth  for  the 
Kluger  paper  on  page  83 . 

(3)  Readey 

In  Reference  9,  Readey  presents  a  structural  reliability  prediction 
method  developed  as  part  of  a  study  under  an  Air  Force  research  contract. 
Rafarance  9  together  with  Reference  10  constitutes  the  couplets  documentation 
of  the  study.  Wagner,  in  Reference  28  which  is  critiqued  later  in  this 
report,  presents  a  brief  summary  of  the  procedure  recommended  in  Reference  10. 
In  that  report,  it  ie  suggested  that  the  procedure  of  Reference  9  be  con¬ 
sidered  for  future  use.  It  le  noted  that  "there  remains  a  significant  amount 
of  method  development  and  parameter  research  to  be  acconplished  before  this 
method  can  be  used  with  the  desired  level  or  accuracy.11  Then,  it  is  stated 
that  "the  level  of  effort  expended  on  this  development  and  research  will 
determine  when  it  will  be  possible  to  require  use  of  this  method." 

The  indication  that  ^e  structural  reliability  can  be  determined  and 
used  as  tha  basis  for  a  specification  is  carried  out  in  the  recommendation 
for  a  future  specification  as  presented  on  page  59  of  Reference  10.  In 
paregraph  3.3  it  is  stated  that  the  "structural  reliability  shall  be  as 
specified  in  the  overall  requirements  of  the  missile  system."  However,  it 
has  been  stated  throughout  the  present  report  that  s  structural  reliability 
requirement  ie  not  feasible  because  there  is  no  satisfactory  proof  of 
oo^dlance  technique  for  demonstrating  .that  such  s  requirement  has  been 
fulfilled.  Section  3.6  recommends  that  a  structural  reliability  goal  be 
incorporated  as  one  of  the  objectives  of  a  structural  design  system. 
Contractually,  establishment  of  a  goal  is  far  different  than  establishing  a 
requirement. 


The  fundamental  difficulty  in  the  procedure  recommended  in  Reference  9 
is  that,  like  References  11  and  12,  any  consideration  of  the  probability  of 
analytical  error  in  the  computations  is  omitted.  As  a  specific  example, 
Reference  9  presents  calculated  reliabilities  of  0.9906  and  0.9741  for  two 
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different  materials.  It  has  bsen  shown  In  Section  III  that  the  true 
reliability  for  similar  examples  «ppi*oaches  0.9  whsn  a  reasonable  error 
function  ie  introduced  into  the  calculations.  Flyura  23  of  this  report  also 
indicates  this  u»  trend.  Such  a  gross  difference  between  the  predicted  and 
true  valises  invalidates  any  decisions  based  on  difference*  between  predicted 
raises  that  are  relatively  small  cohered  to  the  differences  between  the 
predicted  end  true  values. 
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This  critique  would  disagree  with  the  p reads*  of  References  9  and  10 
that  a  structural  reliability  requirement  should  ba  adopted  as  soon  as  wore 
data  are  available.  Statistical  data  always  reprsasnts  a  record  of  the  past. 
Their  value  In  predicting  the  future  depends  on  whether  th*  future  "population" 
represented  by  the  statistical  data  t s  the  same  population  as  the  one  aeasured 
during  the  data  gathering  activity.  In  general,  this  is  not  true  for  ths 
parameters  affecting  the  design  of  aerospace  vehicles. 

Typically,  tha  available  date  are  modified  in  some  way  to  serve  a*  the 
bade  for  the  prediction  of  the  future.  Even  using  the  date  unchanged 
involves  the  implicit  assumption  that  the  future  population  la  identical 
with  the  past  population.  This  may  or  may  not  bs  true.  As  Coutinho  and 
Tiger  say,1"  "We  should  not  assume  that  tha  mathematical  relationships 
derived  frost  hardware  In  current  us*  will  validly  apply  to  the  hardware 
whose  reliability  is  to  be  predicted."  Sections  II  and  III  and  the  dis¬ 
cussions  of  the  Huger  and  l'aire  papers  have  attempted  to  Justify  the 
rejection  of  a  structural  reliability  number  aa  a  criteria  requirement,  even 
if  an  unlimited  amount  of  statistical  data  wan  to  be  made  available. 

Mother  concept  touched  on  in  the  presentation  of  Reference  9  is  safety 
factor  as  an  ignorance  factor.  Such  identification  of  tha  safety  factor  aa 
an  ignorance  factor  is  quits  comaoa  in  th*  literature  on  structural  design 
procedures.  It  la  important  to  decide  whether  or  not  the  structural  design 
procedures  should  incorporate  a  provision  to  compensate  for  ignorance  and.  If 
so,  how  such.  In  this  critique,  the  position  is  taken  that  tha  factor  of 
safety  has  not  been  an  ignorance  factor  and  that  future,  new  systems  should 
not  make  specific  provision  for  ignorance.  There  are  many  different  forms  of 
ignorance.  Insufficient  knowledge  in  the  present  state  of  th*  art  to  solve 
a  particular  problem  is  one  fora  of  ignorance.  Unfamiliarity  with  the  stats 
of  the  art  which  causes  an  analyst  to  use  improper  or  inadequate  procedures 
is  another  form.  It  la  undeniable  that  at  various  times  designs  that  might 
have  been  adequate  because  of  ignorance  on  how  to  arrive  at  ths  proper 
design  have  been  adequate  in  service  because  of  ths  factor  of  safety.  To  us* 
these  fortuitous  circumstances  to  justify  ths  factor  of  safety  as  an 
ignorance  factor  is  a  dubious  conclusion.  For  one  thing,  any  tlsw  that 
ignorance  in  ths  true  state  of  affairs  relative  to  a  structural  design  is 
disclosed,  the  structure  is  modified  accordingly.  The  ignorance  ia  not 
absorbed  in  the  factor  of  safety;  the  structure  is  not  considered  satisfactory 
until  the  effects  of  the  ignorance  are  restored.  For  another  thing,  it  would 
not  be  sufficient  to  absorb  all  ignorance  effects  even  if  th*  factor  of 
safety  were  increased  to  2.0,  5*0,  or  10.0.  There  would  always  be  some 
situation  where  the  ignorance  would  result  in  greater  discrepancies  than  any 
factor  that  might  bs  assigned.  Hors  important ,  to  build  such  a  factor  into 
ths  requirements  would  penalise  all  the  designs  where  lgnoranoe  was  not  a 
consideration.  This  should  not  be  done. 
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(valuation  of  Readey ' »  procedure  b y  the  standard*  listed  in  Seotion  4 >3 
reeulti  in  essentially  the  tame  conclusions  as  thoss  sat  forth  for  tha 

Klugsr  paper  on  ptg*  SI . 

(4)  tea tin 

A  report  by  *actin,  HeTarenoe  29,  presents  a  nw  procedure  for  iha 
etructural  design  of  rahiolaa  subject  to  low-lsrel  turbulence,  This  approach 
to  tha  problem  It  a  unique  combination  of  tha  two  baalo  systems  described  and 
evaluated  in  Sections  II  and  HI.  A a  such,  thara  aba  some  epsclsl  considera¬ 
tion*  involved  In  critiquing  thia  procedure.  Since  tha  procedure  cannot  ba 
dlaraaaad  In  tana  of  tha  functional  diagrams  of  Seotion  IX,  a  naw 
diagram  for  tha  gystsm  ia  presented  aa  Figure  22.  Praaantation  in  thia  fora 
will  halp  in  clarifying  tha  advantages  and  disadvantages  of  Austin's  approach. 

In  tha  analytic  that  follows,  it  ia  shown  that  tha  approach  represents 
a  necessary  atap  In  defining  tha  environment  if  a  quant itatira  atructural 
design  criteria  by  atatiatioal  Methods  ia  to  ba  developed.  However,  it  ia 
also  shown  that  only  a  part  of  tha  problaM  has  bean  considered.  Therefore, 
tha  structure  designed  according  to  tha  procedure  of  Reference  29  any  or  way 
not  aeet  tha  criterion  set  forth  by  Austin.  Thia  criterion  ia  that  "Lose  of 
one  aircraft  due  to  structural  overload  shall  ba  expected  in  1,000  aircraft 
lifetimes."  Furthermore,  tha  procedure  by  itself  has  no  provision  for 
verifying  or  proving  that  the  atructural  cysts*  does  satisfy  tha  criterion. 
These  statements  are  amplified  In  tha  following  discussion. 

Any  of  tha  problem  areas  noted  in  Sections  II  and  III  end  under  tha 
evaluation  of  the  previous  papers  are  applicable  to  Austin's  approach. 

However,  one  of  the  major  problems  has  been  eliminated  by  the  procedure  of 
defining  an  ultimata  design  load.  This  converts  tha  reliability  requirement 
into  a  deterministic  number.  Proof  of  compliance  that  tha  structure  haa  the 
requisite  strength  for  thia  ultimate  design  load  le  the  same  ae  in  the 
Present  $prtam.  The  strength  la  initially  proved  by  submittal  of  a  strength 

- analysis  report.  The  final  proof  of  compliance  la  successful  completion 

of  a  strength  test  load  corresponding  to  the  ultimate  design  load. 

The  difficulty  in  thia  approach  la  that  there  la  no  demonstrable 
correlation  between  the  proof  that  the  structure  can  support  tha  designated 
ultimate  deelgn  load  and  the  actual  failure  rate  due  to  structural  overload. 
Assumption  of  this  correlation  is  tha  basic  premise  of  the  approach.  It  la 
shown  on  Pig ore  22  that  there  le  an  inherent  as adaption  that  the  time  to 
failure,  Tp ,  of  tha  structural  ayatam  will  equal  or  exceed  the  desired 
value  if  a  Design  Ultimate  load  (DUL)  can  be  established  such  that  the  time 
to  exeeed  tha  DUL  is  aqual  to  or  greater  than  Tw,  and  if  the  strength  of  the 
structure  (ae  demonstrated  by  a  strength  teet)  la  grsatar  than  tha  DUL.  This 
relationship  la  shown  dotted  on  Figure  22  because  it  can  ba  shown  that 
fulfillment  of  tha  two  secondary  objectives  does  not  necessarily  mean 
satisfaction  of  tha  primary  object  ire. 

It  ia  presumed  that  the  meaning  of  ths  requires  it  that  tha  strength 
ahculd  exceed  the  DUL  ia  aa  it  ia  ia  tha  Present  System.  If  so,  the  strength 
la  proved  first  by  an  analysis  showing  a  positive  margin  of  safety  and  then 
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by  a  strength  test.  Even  if  the  load  wxoaedanca  curve  la  pracisely  sc 
calculated  and  tha  ERIL  in  precisely  that  load  that  occurs  ones  In  1.000 
aircraft  lifetimes  ae  prescribed,  tha  probability  of  failure  will  not  in 
general  correspond  to  tha  designated  value.  This  i*  ahown  in  Figure  23 
where  curve  (l)  ia  computed  (using  tha  structural  reliability  program 
described  in  Volume  III)  on  the  basis  that  tha  probability  of  exceeding  DtJL 
is  0.001.  It  is  assumed  also  that  the  99-percont- aataad  (tha  typioul 
allowable)  strength  is  Matched  exactly  (*ero  M.S.)  with  the  iMJL,  Ct.irre  (1) 
corresponds  to  the  assu^stiass  of  Sefarsiee  29.  Given  these  conditions  it 
ia  ahown  that  tha  probability  of  failure  varies  widely  from  the  desired 
0.001  value.  Figure  23  identifies  the  significant  affect  that  tha  coefficient 
of  variation  in  strength  has  cn  the  prebabiiity  of  failura.  Thus,  the 
illicit  assumption  on  which  this  procedure  is  based  is  demonstrably  In  error. 
Additional  discussion  of  Figure  23  ia  contained  in  the  Appendix. 

Thar*  are  additional  problems  that  oust  bs  considered  before  it  car,  be 
accepted  that  thia  proposed  procedure  would  result,  in  structural  systems 
that  newt  tha  stated  objective.  In  the  discussion  of  Reference  11  it  is 
noted  that  the  theoretical  analysla  of  probability  of  failure  is  invalidated 
by  errors  in  the  calculation  of  the  loads  and  strengths.  This  discus »i on 
particularly  considers  the  question  of  errors  in  the  strength  analysis.  It 
is  noted  ‘net  10  years  of  static  test  eocpsrlenc*  at  Wright-Patteroon  Air 
Force  P  is,  as  documented  in  Reference  17,  show  that  ei gable  errors  in 
analysis  are  not  infrequent .  The  personal  experience  of  any  knowledgeable 
structural  analyst  should  confirm  the  general  trend  of  the  Reference  17  data. 
The  results  of  a  computation  of  the  probability  of  failure,  considering 
that,  the  error  frequency  ia  equivalent  to  that  of  Reference  17,  are  presented 
as  curve  (2)  on  Figure  23.  This  computation  shows  that,  if  the  determination 
of  the  probability  of  failure  is  baaed  on  analysis  alone,  with  the  possibil¬ 
ity  of  error  included,  the  resulting  value  is  far  from  tbs  desired  value  as 
established  by  Reference  29.  Curve  (2)  also  shews  that,  if  the  accuracy  of 
analysis  is  assssMd  to  be  ten  times  better  or  worse  than  the  Reference  17 
data  indicate,  the  probability  of  failure  resales  at  the  easss  order  of 
magnitude.  Furthermore,  an  assumption  of  log-normal  or  WeibuH  distribution 
rather  than  normal  affects  the  spread  of  curvss  (2)  and  (3)  very  little. 

Curve  (3)  of  Figure  23  indicates  tbs  increment  in  structural  reliability 
resulting  frost  the  usual  practlcs  of  rejection,  during  the  strength  test  to 
the  DUL,  of  most  of  the  undsrstrength  systems.  This  curve  shows  that  the 
probability  of  failure  is  almost  certain  to  be  different  from  the  prescribed 
value,  even  though  the  IXJL  is  precisely  as  desired  and  that  the  strength  of 
tha  structure  ie  developed  through  presently  accepted  analysis  and  testing 
procedures.  The  discrepancy  would  be  further  increased  if  tbs  inevitable 
errors  in  ths  assumed  load  distributions  were  included. 

Sections  XI  and  111  discuss  semes  of  ths  problems  of  calculating  ths  load 
spectrum  accurately.  Because  of  these  difficulties  it  ie  meet  likely  that 
the  actual  probabilities  of  failure  are  worse  than  ths  competed  values 
presented  an  Figure  23  bated  on  the  assumption  of  no  error  let  the  loads 
analysis.  Figure  22  Illustrates  ths  fact  that  ths  DOL  is  dependent  on  ths 
specified  values  of  ths  turbulence  parameters  end  ths  frequency  of  encounter¬ 
ing  both  normal  and  severs  turbulence.  It  is  also  dependent  on  the  dynasdo 


-  91  - 


PROBABILITY  Or 


load  response  of  the  vehicle.  None  of  these  is  subject  to  direct  validation 
during  the  design  and  test  stages  of  a  new  vehicle.  The  spectral  exceedance 
function,  M(y),  and  the  particular  value  H(OUL)  for  the  DUL,  are  subject  to 
coaparisou  only  with  the  analytically  determined  values.  There  is  no 
procedure  suggested  for  verifying  or  proving  compliance  with  this  function 
even  though  it  is  of  equal  importance  with  the  strength  in  ueierauning  the 
actual  failure  rate. 

Finally,  the  desired  failure  rate  of  leas  than  one  in  1,000  lifetimes 
cannot  be  verified  statistically.  Che  failure  at  an  early  stage  of  fleet 
deployment  does  not  prove  that  the  average  failure  rate  is  greater  than  the 
established  rate.  It  is  conceivable  that  the  failure  was  a  random  one  and 
that  there  will  be  no  further  failures  during  the  fleet  life.  Even  if  there 
are  two  or  three  failures,  there  is  no  absolute  proof  of  non-compliance , 
although  such  a  situation  would  obviously  represent  presumptive  evidence. 

The  foregoing  is  the  crux  of  the  argument  that  Austin's  procedure  does 
not  insure  that  operational  vehicles  will  meet  the  prescribed  failure  rate. 
This  is  not  to  ssy  that  most  of  them  won't  be  reliable  enough.  Most  will  be. 
This  is  not  to  say  that  the  analytical  procedure  for  determining  the  gust 
environment  and  vehicle  response  should  not  be  vigorously  pursued.  What  it 
does  say  is  that,  after  following  the  procedure,  the  resulting  vehicle  may 
or  may  not  have  the  desired  failure  rate.  The  same  thing  could  be  said  of 
any  other  procedure  no  matter  how  unsophisticated.  Therefore,  the  presump¬ 
tion  that  the  procedure  will  always  prevent  the  failures  that  have  occurred 
in  low-level  operations  cannot  be  substantiated.  Neither  can  the  implica¬ 
tion  that  other  procedures,  such  as  the  discrete  gust  procedure  of  MIL-A-6S61, 
are  unacceptable  be  sustained.  The  fact  that  this  procedure  is  very  logical 
for  the  problem  it  considers  is  no  Justification  for  deciding  that  it  is  the 
best  procedure  when  all  of  the  considerations  that  affect  structural  design 
are  included  in  the  formulation  of  the  problem. 

There  are  several  additional  question*  that  should  be  considered  in 
evaluating  thle  approach.  These  are  secondary  to  the  basic  questions  but 
they  will  affect  any  future  application  of  this  procedure.  The  first  of 
these  questions  involves  the  technique  associated  with  the  pow’sr  spectral 
approach.  There  is  some  question  whether  the  basic  assiu^xbions  involved  in 
Rice's  original  paper^  are  applicable  to  the  determination  of  the  frequency 
of  occurrence  of  extremely  large,  extremely  rare  gusts  such  as  would  be 
involved  in  the  Design  Ultimate  Load.  In  some  ways  such  large  and  rare  gusto 
answer  the  description  of  a  discrete  gust  which  is  the  bads  for  the 
KIL-A-8861  requirements  and  most  aircraft  gust  design  to  date.  Rice's  work 
and  the  adaptations  of  it  cited  by  Austin  in  References  29,  30  cad  31  are 
based  on  certain  fundamental  assumptions  that  may  be  violated  when  applied 
to  the  problem  of  extremely  large  gusts.  The  description  of  the  gust 
environment  by  the  power  spectral  technique  proba'.ly  Is  quits  adequate  and 
not  a  violation  of  the  fundamental  assumptions  for  the  lower  amplitude 
gusts  that  contribute  largely  to  the  fatigue  problem  on  aircraft.  It  is 
assumed  that  the  process  is  a  stationary,  random  process.  Further,  it  is 
assumed  that  the  process  also  belongs  to  the  subcLass  known  as  ergodlc. 
Furthermore,  the  prediction  of  the  frequency  of  exceedance  function  is 
dependent  on  the  assumption  of  a  normal  or  Gaussian  distribution.  There 


-  93  - 


is  evidence  that  gust  distribution  is  non-Gaussian.  It  is  beyond  the  scope 
of  this  paper  to  delve  deeply  into  the  mathematical  verities  of  the  power 
spectral  technique  as  applied  to  the  definition  of  large  magnitude  gusts. 
However,  qualified  mathematicians  should  examine  this  question  very 
thoroughly  rather  than  uncritically  adopting  the  technique  as  the  design 
requirement. 

'  The  validity  of  the  mini) era  obtained  for  design  purposes  is  crucially 
dependent  on  the  environment  defining  parameters  such  as  set  forth  in 
Table  1  of  Reference  29  and  on  the  frequency  response  function,  T(Q),  of  the 
vehicle.  Unless  there  is  a  practical  technique  for  verifying  these  nunbers 
or  the  exceedance  rate  of  DUL,  the  Austin  approach  cannot  be  administered 
properly.  There  are  two  other  detail  problems  that  were  not  considered 
explicitly  in  the  development  of  this  procedure.  The  first  is  the 
possibility  that  the  falling  strength  of  the  structure  may  be  time  dependent. 
There  is  an  implicit  assumption  in  the  approach  that  no  structure  will 
ever  fall  at  less  than  the  DUL  at  any  time  during  the  1,000  lifetimes  and 
that  all  structures  will  fail  if  the  DUL  is  exceeded.  If  the  instantaneous 
strength  at  any  time  during  the  vehicle  lifetime  Is  higher  or  lower  than  the 
DUL,  the  failure  rate  will  not  be  identical  with  the  frequency  of  exceeding 
the  DUL.  Thus,  the  basic  goal  of  Reference  29  might  not  be  met  even  if  the 
proceduro  given  for  the  derivation  of  the  design  ultimate  load  is  followed 
precisely. 

The  second  detail  problem  Involves  the  definition  of  the  DUL  for  more 
than  one  parameter.  Reference  29  does  not  discuss  the  situation  explicitly 
but  there  is  an  implied  consideration  of  more  than  one  load  at  a  time.  The 
procedure  speaks  of  Design  Ultimate  Loads  in  several  places  and  the  term 
"specified  response”  is  used.  Also,  Reference  31  speaks  of  wing  bending 
moment,  fin  shear  and  fin  banding  moment.  Therefore,  it  can  be  assumed 
that  there  would  be  a  DUL  for  every  critical  location  throughout  the  vehicle. 
Failure  at  given  location  is  not  usually  a  function  of  a  single  parameter. 
There  are  interactions  between  the  various  loading  conditions.  It  might  be 
necessary  to  know  the  shear,  bending  moment  and  torque  at  one  wing  station 
together  with  the  same  parameters  at  Inboard  and  outboard  stations  (to  allow 
for  shear  lag  effects,  for  one  thing).  In  addition,  it  might  be  necessary 
to  know  the  local  pressure  because  of  its  effect  on  panel  buckling.  If  a 
DUL  for  each  of  these  parameters  is  calculated,  the  resulting  combination 
may  not  represent  the  true  failing  situation  at  all.  It  is  quite  possible 
that  the  combination  of  the  various  Design  Ultimate  Loads  might  result  in  a 
physically  incompatible  situation.  Determination  of  structural  survival  or 
failure  requires  the  definition  of  a  discrete  set  of  physical  loads  that 
occur  simultaneously. 

The  problems  represented  by  the  time-dependency  question  and  snlti- 
parameter  failure  modes  are  not  inherent  in  the  proposed  procedure.  These 
problems  could  be  solved  within  the  framework  of  Austin's  philosophy 
although  the  details  of  how  to  accoaplish  the  solution  are  not  clear  at  the 
present  time.  A  word  of  caution  ie  pertinent  at  this  point.  Rsfsrsncs  29 
(and  others)  have  discussed  functions  such  as  M(y)/IL  as  though  they 
represented  the  probability  of  exceeding  a  value  of  the  parameter  in 
question.  For  instance,  on  page  3  of  Reference  30  it  speaks  of  "the 
probability  of  equaling  or  exceeding  the  response  parameter,  y,  can  be 
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expressed"  as  K(y)/K0.  On  page  3  of  Reference  31  it  as jra  that  "M(y)/N0  ia  the 
probability  of  exceedance"  of  the  true  gust  velocity.  NASA  data  on  the 
statistics  of  maneuvers^  has  been  presented  in  a  similar  fora. 


It  Is  not  spparsn  t>  to  Uii5  u*Ainit  is,  ted  that  this  tjrp©  of  probability 
is  a  conditional  probability.  It  represents  the  probability  that,  if  a  gust 
(or  maneuver)  is  encountered, the  value  of  that  one  gust  will  exceed  the 
value  y.  This  conditional  probability  can  be  envisioned  as  the  fraction 


of  the  gusts  exceeding  a  given  value  out  of  all  the  gusts  being  considered. 
Accordingly,  the  probability  of  the  gust  velocity,  shown  at  the  10“6  level 
on  Figure  2  of  Reference  31,  may  actually  approach  1.0  if  there  are  10^  gusts 
involved.  _  Likewise,  the  probability  of  exceeding  the  gust  velocity  shown 
at  the  10“1  level  may  approach  zero  if  the  nunfcer  of  gusts  approaches  zero. 
Another  way  to  explain  the  situation  is  to  point  out  that  M(y)/N0  is  the  same 
whether  one  is  considering  one  hour  or  a  million  hours  of  flight.  Cn  the 
other  hand,  the  probability  of  exceeding  a  given  gust  velocity  Increases 
steadily  as  the  time  involved  increases  from  one  to  a  million  hours. 


Experience  has  shown  that  the  conditional  probability  form  of  the  function 
is  not  as  meaningful  and  significant  to  the  average  engineer  as  is  the 
probability  of  exceedance  during  a  specified  period. 


There  are  several  interesting  questions  pertaining  to  the  philosophy  of 
structural  design  criteria  and  structural  design  systems  that  are  raised  by 
Reference  29.  One  is  the  precise  meaning  of  structural  reliability  or 
Austin's  variant,  the  total  time  to  failure.  In  the  discussion  of  Reference 
11,  it  is  pointed  out  that  there  are  three  orders  of  reliability.  It  appears 
that  Reference  29  is  concerned  with  a  group  or  fleet  of  nominally  identical 
vehicles  of  a  particular  design.  Ihe  question  neede  to  be  clarified  in 
establishing  the  objective  of  the  procedure. 


Another  philosophical  question  that  is  pertinent  to  the  evaluation  of 
any  procedure  such  as  Reference  29  is  the  procedure  for  defining  the  mission 
for  which  the  vehicle  is  to  be  designed.  Coutiniw,-J*  along  with  many  others, 
points  out  that  "It  is  not  possible  to  build  a  mininuai  weight  airframe 
structure  which  will  never  fail."  Elsewhere  in  hie  paper,  Coutinho  states 
that  "The  objective  of  these  (reliability)  procedures  is  to  produce  an 
airframe  structure  of  minimum  weight  which  will  perform  its  mission  without 
failure."  Both  of  these  statements  imply  that  failure  may  be  more  acceptable 
during  operations  beyond  the  specified  mission. 


The  specified  or  deeign  mission  for  an  aerospace  vehicle  is  of  extreme 
importance  in  the  question  of  the  structural  integrity  of  an  aerospace 
vehicle .  Once  the  vehicle  is  designed  and  in  operation,  its  structural 
integrity  depends  cn  insuring  that  the  operations  are  no  more  severe  than 
those  of  the  specified  mission,  In  Austin's  procedure,  there  is  an  inherent 
assumption,  used  many  times  previously,  that  the  future  mission  and  ths 
resulting  operations  will  be  the  same  as  in  the  past.  Obviously,  this  ia 
not  necessarily  ths  ease.  Therefore,  the  f dllure  rate  that  is  established 
as  ths  objective  in  Reference  29  must  be  qualified  as  th«  rats  that  will  be 
obtained  if  the  vehicles  are  all  operated  in  accordance  with  the  specified 
mission .  It  must  be  accepted  that  if  ncn-specifled  missions  ere  flown,  the 
failure  rate  most  likely  will  be  different  than  the  specified  value. 
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This  is  not  to  aay  that  alternate  mission  capability  should  not  be 
incorporated  as  part  or  the  specified  trdssion.  If  flexibility  in  deployaant 
is  required,  It  oust  be  designed  into  the  vehicle.  Particularly  difficult 
to  resolve  is  the  question  of  whether  operational  vehicle  should  be 
for  non-oper&tional  usage  such  as  air-show  demonstrations  and 
research  projects.  It  seems  obvious  that  such  requirements  should  not  be 
allowed  to  increase  the  weight  of  a  vehicle  capable  of  satisfactorily 
fulfilling  the  normal  military  requirements.  Nevertheless;  It  is  difficult 
to  resist  the  pressures  to  beef-up  a  vehicle  that  fails  during  such  extra¬ 
curricular  activities.  Perhaps  the  solution  is  to  specify  what  the  vehicle 
is  not  intended  to  be  good  for  as  well  as  what  it  issst  be  good  for. 

In  any  event,  if  the  vehicle  is  to  be  designed  for  a  specifically 
limited  mission,  there  is  a  missing  link  in  the  development  of  structural 
reliability  when  there  is  no  specified  interface  with  non-structural  systems 
including  flight  operations.  To  prevent  structural  failures  there  oust  be 
a  control  procedux _  to  lirlt  the  structural  environment  to  that  for  which 
it  is  capable  of  survival.  This  control  procedure  should  include  allocation 
of  responsibility  for  specified  actions  and  monitoring  th«  results  of  such 
actions  to  provide  timely  warning  of  more  severe  operations  than  would  be 
encountered  while  performing  the  specified  mission. 

Another  problem  is  hew  to  restrict  the  operations  to  the  prescribed 
operational  capabilities  of  the  vehicle.  Limit  conditions  are  a  vary  useful 
tool  of  cosmunicating  the  operational  limitations  to  the  user.  Absence  of 
any  determination  of  limit  conditions  may  prove  to  be  a  critical  omission 
in  Austin's  approach. 

Another  important  aspect  of  the  need  to  define  the  interfaces  with 
other  systems  is  illustrated  by  the  discussion  of  the  use  of  a  yaw  stability 
augmentation  system  (SAS)  to  reduce  fin  loads.  Use  of  such  a  system  to 
reduce  the  Design  Ultimate  Load  (DUL)  raises  a  very  significant  question  for 
structural  design  criteria  —  whether  or  not  statistical  methods  are 
involved.  It  ie  quite  conceivable  that  the  SAS  could  be  so  affective  in 
reducing  the  DUL  that  the  structure  would  be  almost  certain  to  fail  if  the 
SAS  failed.  There  are  many  other  instances  known  where  the  load  environment 
of  the  structural  system  is  dependant  on  the  proper  functioning  of  a  non- 
structural  system.  There  is  no  indication  on  Figure  8  of  Reference  31  that 
any  provision  has  been  made  for  including  the  probability  of  failure  of  the 
SAS  in  the  calculation  of  the  load  spectrum  wit**  stability  amputation. 

Sven  more  important  than  such  a  calculation  (wuich  is  subject  to  the  possi¬ 
bility  that  the  non-structural  system  will  fail  'Uf.re  often  than  assumed)  is 
a  question  that  must  be  decided  somewhat  arbitrarily.  The  question  of  who 
is  responsible  for  preventing  a  structural  failure  due  to  failure  in  a  non- 
structural  system  (including  a  SAS)  is  an  executive  decision.  The  decision 
can  be  that,  if  the  non-structural  system  fails,  the  structural  system  is 
expected  to  tolerate  and  survive  the  resulting  loads.  On  the  other  hand, 
the  decision  could  be  that  the  structure  is  not  required  to  survive  such  a 
non-structural  failure.  In  this  ca ns,  the  responsibility  for  preventing 
the  failure  rests  with  the  non- structural  system  *hich  must  be  so  designed 
so  that  it  will  not  fail  any  oftenar  than  vlU  be  tolerated  for  structural 
failure.  In  other  words,  the  responsibility  for  preventing  the  structural 
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failure  is  transferred  to  the  non- structural  system.  This  has  many  ramifi¬ 
cations  that  need  to  be  explored  further. 

Evaluation  of  Austin's  procedure  by  the  standards  listed  in  Section  4*3 
results  in  the  following  conclusions: 

1.  The  procedure  establishes  very  explicitly  the  Desired 
State  of  the  structural  system.  The  Desired  State  is  that 
there  should  not  be  more  than  one  aircraft  loss  due  to 
structural  overload  in  1,000  aircraft  lifetimes. 

2.  The  procedures  makes  no  direct  provision  for  accurately 
determining  the  actual  failure  rate  for  comparison  with  the 
desired  value.  It  is  assumed  that  calculation  of  a  Design 
Ultimate  Load  which  has  a  frequency  of  exceedance  of  one  in 
a  thousand  will  result  in  an  operational  system  which  will 
have  a  structural  failure  rate  less  than  one  in  a  thousand. 

There  are  many  reasons  why  such  an  assumption  cannot  be 
Justified.  For  one.  Figure  23  shows  that  the  probability 
of  failure  can  vary  from  0.37  to  0.000068  depending  on  many 
parameters  other  than  the  probability  of  exceeding  Design 
Ultimate  Load. 

3.  The  procedure  makes  no  explicit  provision  for  disclosing 
discrepancies  between  the  Desired  State  and  Actual  State. 

There  is  an  implied  assumption  that  the  structure  will  be 
3trength-tested  to  the  Design  Ultimate  Load.  Curve  3  of 
Figure  23  shows  that  the  probability  of  failure  after  com¬ 
pletion  of  the  typical  strength  test  can  vary  from  0.021  to 
0.00029,  depending  on  the  coefficient  of  variation  in 
strength  (and  to  a  small  degree  on  the  type  of  strength  and 
load  distribution).  This  difficulty  in  determining  the  true 
probability  of  failure  when  the  load  distribution  is  assumed 
to  be  known  is  compounded  when  possible  errors  in  load  dis¬ 
tribution  are  introduced.  As  a  consequence,  there  is  no 
rational  and  accurate  mechanism  for  determining  whether  the 
vehicle  structural  system  actually  satisfies  the  specified 
objective  of  the  procedure. 


Austin's  development  of  a  rational  probability  analysis  technique  for 
defining  the  Design  Ultimate  Load  for  aircraft  is  a  significant  contribution 
to  the  state  of  the  art.  In  particular,  an  inherently  logical  approach  of 
establishing  a  quantitative  objective  is  followed.  A  procedure  intended  to 
satisfy  this  quantitative  objective  is  developed.  All  the  discussion  in  this 
evaluation  of  Austin's  approach  is  concerned  with  the  detail  problems  of 
implementing  the  objective.  It  is  suggested  that  the  proposed  technique 
should  be  considered  as  a  good  beginning  to  the  solution  of  an  important 
technical  problem.  This  first  step  should  be  followed  up  by  expanding  the 
approach  to  include  more  of  the  pertinent  considerations  involved  in  defining 
the  true  structural  reliability. 
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(5)  Taylor 

A  be  ok  by  Taylor,  Reference  35,  Is  a  reference  work  concerning  the  loads 
experienced  by  aircraft  plus  a  chapter  on  design  philosophy.  The  book's 
chapters  or  loads  are  fiH  VXOlllfilC  of  &Ii  tht  phvaiovniA  th&t 

induce  loads  on  aircraft,  men  of  Taylor' s  data  is  presented  in  the 
statistical  format  that  is  nsoessary  for  a  structural  reliability  approach. 

In  short,  there  is  a  wealth  of  pertinent  statistical  information  presented 
in  a  convenient  package.  However,  as  in  any  manual  or  handbook  of  this  type, 
there  can  never  be  enough  information  prea«t<?1  between  the  covers  of  a  book 
to  serve  as  the  sole  source  for  the  design  of  e  Modem,  sophisticated  aero¬ 
space  vehicle.  It  can  only  be  a  good  start. 

Chapter  13 ,  titled  Design  Philosophy,  is  a  convenient  presentation  of 
what  Taylor  considers  should  be  incorporated  in  a  rational  design  procedure. 
All  of  the  alements  involved  in  the  structural  reliability  approach  am 
discussed,  boms  sore  extensively  than  others.  The  basic  philosophy  of 
Reference  35  can  be  characterised  ae  the  Purely  Statistical  Structural 
Reliability  System  evaluated  in  Sections  XI  and  III.  Mary  of  the  problem 
areas  noted  in  these  discussions  end  under  the  evaluation  of  Reference  11  are 
applicable  to  Taylor's  approach.  However,  Taylor  shows  more  awnmnese  of  the 
problems  than  most  authors  in  the  field  of  structural  reliability  even  though 
he  doesn't  present  solutions. 

Rage  282  of  Reference  35  defines  the  essence  of  the  approach  followed. 

It  states  that  "The  refinement  that  is  introduced  by  this  procedure  is  that 
the  applied  loads  and  design  strengths  are,  after  manipulation,  related  by 
one  single  numerical  value.  This  is  a  direct  measure  of  reliability;  hovavor 
it  has  been  obtained  from  formulae  for  frequencies  of  occurrence  of  load:  and 
strengths  that  are  extrapolated  far  beyond  practical  experience .  Thus  the 
engineering  Judgement  that  was  used  to  estimate  the  factor  between  applied 
load  and  design  strength  is  transferred  to  estimating  the  appropriate  formulae 
for  extrapolation." 

Reference  35  starts  the  disoourse  on  Design  Philosophy  by  noting  that 
"The  purpose  of  all  philosophies  of  structural  design  is  to  produce 
reliability  and  reliability  may  be  defined  as  the  certainty  with  which  the 
structure  should  withstand  the  loads  that  say  be  applied  to  it."  On  page 
286  it  is  stated  that  "...it  cannot  be  emphasised  too  strongly  that  the 
object  of  structural  design  is  to  obtain  a  design  that  is  reliable." 

One  aspect  of  tha  structural  design  problem  that  is  not  included  in  the 
objective  is  consideration  of  structural  weight  along  with  reliability. 

Anyone  can  design  an  extremely  reliable  structure  if  weight  is  of  no  concern.. 
However,  Christenson^®  points  out  thst  "Design  for  safety  does  not  mean  pur» 
brute  strength  without  regard  for  sconomic  feasibility."  Nothing  would 
destroy  the  economic  feasibility  of  an  airline  aircraft  more  quickly  than  a 
grossly  overweight  structural  systaau  Coutinho34  recognises  minimum  weight 
as  a  structural  objective  ttom  ha  says  "Tha  objective  of  these  procedures  la 
to  produce  aa  airframe  structure  of  minimal  weight  which  will  p_f  rrr;  Its 
mission  without  failure.  Achievement  of  minimum  weight  is  s  wagmtitive 
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consideration,  whereas  structural  safety  In  to  Ira  a  safety  of  Ufa  and  la  an 
absolute  necessity. "  Bouton?  stated  the  prbblea  in  slightly  different  form 
—  "Tha  question  to  b«  answered  is;  How  weak  nan  we  design  our  (structures 
without  incurring  tha  risk  of  ’too  many'  failures?" 

Another  facet  of  the  statement  of  objective  in  Reference  35  that  should 
be  considered  very  carefully  ie  the  pronouncement  that  "the  structure  should 
withstand  the  loads  that  may  be  applied  to  it."  This  should  not  be  an 
tmquallfi  d  statement.  It  should  not  be  the  intention  that  the  structure 
should  survive  any  conceivable  gross  overload  including  situations  pre¬ 
cipitated  by  failure  of  non- rt  ru  ct urs 1  systems  nor  should  it  he  the  intention 
that  the  etructure  should  tolerate  any  conceivable  grooa  error  in  the  design* 
fabrication  and  maintenance  of  the  structure.  It  should  be  the  responsibility 
of  the  structural  system  to  survive  only  a  limited  range  of  definable  opera¬ 
tional  situations.  Responsibility  for  avoidance  of  failure  beyond  these 
defined  situations  must  be  assigned  to  and  accepted  by  systems  other  than 
the  structural  system.  The  structural  design  system  should  identify  and 
define  these  interfaces  with  non-structural  systems. 

Reference  35  establishes  "the  reciprocal  of  the  combined  frequency  that 
the  load  is  greater  than  the  strength"  as  the  numerical  value  for  reliability. 
It  also  states  that  the  dimension  of  reliability  "must  inevitably  be  number 
of  hours  per  failure."  However,  it  does  not  make  clear  how  a  particular 
value  of  reliability  will  be  established  as  a  requirement  for  a  particular 
vehicle  system.  Furthermore,  on  page  266  the  absolute  value  of  reliability 
is  judged  to  be  "most  inaccurate."  Despite  this  appraisal,  it  is  stated 
without  qualification  on  page  300  that  "The  reliability  of  the  structure 
under  static  loads  is  calculated  using  the  following  three  parameters...." 

Oh  page  301  it  is  stated  that  "The  probability  of  failure  is  given  by. . . 
Equation  13. 1."  This  equation  forms  the  basis  for  the  subsequent  analyses. 

The  nature  of  the  Desired  State  definition  in  the  procedure  is 
illustrated  by  the  suggestion  on  page  267*  It  is  proposed  that  the  overall 
reliability  of  a  structure  (measured  in  hours  to  failure)  be  multiplied  by 
factor  of  10.  This  arbitrary  value  ia  based  on  the  assumption  that  the 
weakest  part  will  contribute  at  least  10  percent  to  the  total  chance  of 
structural  failure.  If  the  absolute  value  is  most  inaccurate  and  the 
relationship  between  part  reliability  and  total  reliability  is  not  really 
known,  it  is  difficult  to  comprehend  what  will  be  gained  by  establishing  an 
absolute  reliability  requirement  for  a  particular  design. 

Che  other  concept  in  the  definition  of  the  Desired  State  is  the 
aseunption  on  page  325  that  it  is  common  practice  to  allow  margins  for 
error  and  for  ignorance.  This  ia  a  common  assumption  that  should  be 
challenged.  Curve  2  in  Figure  23  in  the  critique  of  Reference  29  shows  that, 
if  the  ignorance  and  error  represented  by  the  design  practices  revealed  by 
the  Wright  Field  test  data  of  Reference  17  is  any  criterion,  approximately 
one  out  of  every  ten  vehicles  would  fail  even  when  tha  cenmr*’  1,5  factor  of 
cafety  is  incorporated  in  the  design,  TT-at  is,  one  out  of  ten  would  fail  if 
the  errors  were  permitted  to  remain  in  the  operational  vehicles  by  omitting 
the  static  test.  If  the  errors  are  disclosed  by  a  testing  operation  and  the 
design  corrected  to  eliminate  these  errors,  then  the  reliability  increases 
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to  ths  desired  value  —  provided  tb#  coefficient  of  strength  variation,  yg, 

4  ■  §.£  *h±  ordsr  c£  the  sisirospics  structure  of  ths  Must  (Reference  35 

states  that  th*  valua  is  l»sa  than  0-043)  aod  provided  that  th*  loads  error* 
are  eliminated  by  flight  teat  measurements.  Scatter  in  strength  and  load  is 
not  syn onynou*  with  error  hut  It  a  faet  of  lift  that  must  b#  considered  in 
the  determination  of  th*  etructural  design.  If  th*  M**ft  it  calculated  or 
predicted  to  bt  at  on#  value  and  if,  in  truth,  it  it  at  a  value  only  half  at 
large,  then  this  discrepancy  is  en  error « 

Another  element  of  tht  Desired  State  that  it  not  considered  it  the 
probability  of  failur*  at  licit  load  or  lets.  Sections  II  and  III  note  that 
a  s«ro  failure  rate  is  desired  at  licit  conditions  or  lees.  This  re quire  cant 
la  established  by  th*  fact  that  licit  conditions,  by  definition,  are 
permissible  and,  thus,  expected  to  be  safe.  A  situation  such  as  illustrated 
by  Case  B  on  Taylor's  Figure  13. 3  should  not  be  considered  as  acceptable 
even  if  th*  total  failur*  rate  is  acceptable.  The  illustration  shows  about 
30  to  40  percent  of  ths  failures  occur  below  the  2.64  0  value  designated  as 
the  expected  or  limit  conditio.  Reference  5  proposes  that  a  licit  reliabil¬ 
ity  objective  be  established  corresponding  to  no  cor*  than  one  percent  of  the 
total  nuebar  of  failures  that  would  bs  tolerated. 

Ohs  final  consent  should  bs  mds  on  ths  Desired  State  for  structural 
reliability  during  landings  as  illustrated  in  th*  exasg>le  in  Reference  35. 

A  failure  rate  of  one-in-t an- nd  111  on  landings  is  selected  a*  a  goal  (or 
Desired  State).  It  is  indicated  that  the  exasple  aircraft  are  expected  to 
achieve  10,000  landings  per  lifetime.  On  this  basis  one  landing  failure  in 
every  thousand  aircraft  ic  established  as  the  goal.  Since  core  than  10,000 
DC-3/ 0-47  type  aircraft  were  put  in  service,  this  would  asan  that  applica¬ 
tion  of  the  procedure  would  deliberately  set  a  design  goal  that  would  result 
in  about  10  landing  failures  for  this  type  aircraft.  This  is  ths  result  that 
would  be  attained  if  the  design  were  exactly  as  predicated  by  the  analysis 
of  psgss  308  to  311,  It  could  be  worse  if  any  errors  ara  cade  in  the 
analysis.  It  ie  questionable  whether  such  a  goal  would  be  acceptable  in  the 
design  of  coneercial  transport  aircraft. 

Th*  determination  of  the  Actual  Stats  of  the  structural  reliability  of 
a  given  structural  system  depends  almost  exclusively  in  th*  procedure  of 
Reference  35  on  the  evaluation  of  Equation  13.1  on  page  301.  An  initial 
formulation  of  ths  load  and  strength  distribution  is  given  in  Equations  13*2 
and  13.3.  Subsequently,  other  distributions  are  introduced  for  consideration. 

Before  presenting  Equation  13.1,  Taylor  makes  a  cogent  observation 
that  should  bs  considered  by  all  those  who  are  developing  structural 
reliability  procedures.  "Throughout  the  analysis  the  probability  of  failure 
will  be  determined  as  the  sum  of  the  probability  of  failure  at  each  strength. 
Mathematically  this  is  identical  to  the  jum  cf  the  probability  of  failure  at 
esch  applied  load,  but  physically  it  i„  more  realistic  to  think  in  terms 
of  structures  that  broke  because  the  load  surpassed  their  strength  than  in 
terms  of  loads  that  caused  failure." 

Reference  35  presents  several  distributions  of  strength  including  normal, 
exponent!*!  and  biaod-i .  The  biaxial  distribution  is  described  in  terms  of 
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&  main  family  and  weak  family.  The  phenomenon  of  a  weak  family  in  a  strength 
distribution  appears  to  be  more  common  than  most  other  authors  assume.  The 
blmodal  distribution  generally  has  a  major  effect  on  the  calculation  of 
structural  reliability.  As  Taylor  put  it,  "Attention  has  already  been 
drawn  to  the  added  complication  that  the  exceptionally  high  loads  and  the 
exceptionally  low  strengths  may  well  be  from  families  that  are  subsidiary 
to  the  two  sain  ones.  The  contribution  from  the  subsidiary  families  to 
the  calculated  probability  of  failure  will  be  a  large  proportion  of  the 
total,  which  will  consequently  be  subject  to  considerable  error." 

The  load  distributions  in  Reference  35  are  representative  of  the  data  that 
is  generally  available .  As  with  the  strength  distributions,  it  is  pointed 
out  that  many  loading  distributions  are  blmodal.  It  is  explained  that  there 
is  "a  strong  possibility  that  the  measurements  will  be  only  from  the  main 
family.  Thus,  a  subsidiary  family  will  need  to  be  postulated  for  the  severe 
conditions,  basing  it  on  evidence  from  other  types  of  loading  conditions 
in  which  the  extreme  conditions  have  been  experienced."  The  accuracy  of 
extrapolations  based  on  very  limited  quantities  of  data  is  exemplified  in 
the  illustrative  problem.  On  Figure  13.13  the  load  distribution 
function  is  extrapolated  to  10~7  and  b eyond .  The  curve  is  based  on  records 
of  320  landings  documented  on  Figure  13 .6C.  As  noted  on  page  10$  Reference  35 
acknowledges  that  a  factor  of  ten  should  be  applied  to  the  number  of  data 
points  to  define  a  probability  with  even  90  percent  confidence.  This  means 
that  the  loading  data  is  valid  only  to  one  in  32  or  0.03  (five  orders  of 
magnitude  lower  tlian  the  region  of  most  interest).  The  difficulty  is  spot¬ 
lighted  still  more  by  the  use  of  a  normal  distribution  and  an  exponential 
distribution  with  their  obviously  large  difference  in  the  region  with  the 
most  inpact  on  the  final  results  of  the  reliability  calculation. 

Figure  13.13  and  the  attendant  discussion  can  be  used  as  the  perfect 
illustration  of  the  problem  of  administering  a  Purely  Statistical  Structural 
Reliability  System.  It  can  be  assumed  that  various  analysts  confronted  with 
a  real  design  problem  might  arrive  at  a  range  of  designs  comparable  to  the 
five  solutions  presented  on  Figure  13.13-  Who  can  doubt  that  the  competitive 
considerations  Coutinho^  speaks  of  might  lead  some  contractors  to  the 
lightest  weight  design  shown  as  Condition  A.  Cn  the  other  hand  an  engineer 
at.  the  procuring  agency  might  decide  Condition  E  was  more  realistic.  This 
would  require  a  mean  strength  about  46  percent  higher  than  required  for 
Condition  A.  The  corresponding  weights  would  undoubtedly  be  close  to  the 
same  proportions.  Reference  35  in  posing  the  problem  gives  no  hint  of  how  the 
choice  could  be  made  objectively.  It  is  postulated  in  this  critique  that 
such  problems  are  deterrents  to  a  universal  acceptance  of  structural 
reliability  as  the  basis  for  structural  design  criteria. 

Evaluation  of  Taylor’s  procedure  by  the  standards  listed  in  Section  4.3 
results  in  the  following  conclusions: 

1.  The  approach  is  based  on  the  achievement  of  structural 
reliability  which  is  defined  "as  the  certainty  with  which 
the  structure  should  withstand  the  loads  that  may  be 
applied  to  it."  It  is  indicated  that  there  would  be  a  pre¬ 
scribed  standard  of  reliability.  In  an  exaaple  case  a  failure 
rate  of  one  in  10?  landings  is  chosen.  While  Reference  35  is 
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not  too  explicit  on  how  the  Desired  State  value  of  structural 
roll  ability  would  be  chosen,  it  it  dear  that  such  a  number 
would  represent  the  Desired  State  in  the  proposal. 

2»  the  pistl tr%  of  determining  the  Actual  State  of  the  reliability 
Of  a  etrootural  system  la  not  eolred  by  the  proposed  procedure. 

The  procedure  presents  the  same  difficulty  as  most  of  the 
other  approach ee  in  that  it  depend  e  exclusively  on  the  cosquted 
structural  reliability  and  doss  not  recognise  the  possibility 
of  errors  in  the  computations. 

3.  A  numerical  example  of  the  procedure  applied  to  the  solution 
of  a  landing  reliability  problea  ie  presented.  Five  cases 
with  various  assumptions  for  the  load  and  strength  distribu¬ 
tions  are  discussed.  All  have  the  aaae  calculated  structural 
reliability  yet  the  range  of  strength  is  such  that  the  aean 
strength  of  the  strongest  is  about  4b  percent  greater  than 
that  of  the  weakest.  Any  one  of  the  five  designs  would 
apparently  satisfy  the  requireaanta  yet  no  procedure  is 
presented  for  deciding  which  one  to  ohoose  initially.  Also, 
if  one  designer  chose  +he  weakest  design  and  another  designer 
the  strongest,  no  procedure  ie  proposed  for  diocloning  which 
system  meets  the  prescribed  failure  rate  and  which  does  not. 

(6)  Lundberg 

A  paper  by  lundberg,  Reference  13,  presents  the  giet  of  the  extensive 
work  by  Lundberg  and  hie  colleagues  in  the  field  of  structural  design 
criteria  by  a  quantitative  statistical  approach.  Much  attention  is  concen¬ 
trated  on  the  fatigue  aspects  of  the  structural  reliability  problem.  Other 
presentations  of  the  approach  are  given  in  References  37  to  39. 

Many  of  the  problem  areas  described  in  the  discussions  in  Sections  II 
and  III  and  those  considered  in  the  evaluation  of  XI  tiger' s  paper  axe  appli¬ 
cable  to  Lundberg1 s  approach.  In  the  Reference  13  approach  there  is  no 
procedure  for  accurately  measuring  the  actual  structural  reliability  of  a 
particular  structural  design.  As  a  result,  th  >re  is  no  proof  of  compliance 
techniqus  available  to  verify  the  analysis  and  demonstrate  that  a  contractual 
requirement  has  been  fulfilled. 

Two  assumptions  that  are  made  in  Reference  13  boar  cn  the  difficulty  of 
analytically  predicting  the  structural  reliability  of  a  new  design.  lundberg 1 s 
approach,  called  the  "Allotment  of  Probability  Shares,"  or  APS,  is  based 
on  an  inherent  assumption  that  the  probability  of  failure  of  each  part  in 
an  aircraft  structure  is  independent  r f  every  other  pert.  The  probability 
that  is  to  be  allocated  ie  the  probability  of  failure  per  aircraft  hour. 

This  probability  is  derived  from  such  considerations  as  an  estimate  of  the 
number  of  individual  accidents  that  will  be  tolerable,  the  numbers  of 
passengers  per  aircraft,  the  average  aircraft  speed  and  the  passenger-miles 
per  year. 

Th*  hazards  of  predicting  the  future  on  the  basis  of  past  experience 
teller fcd  by  sosm  ferns  of  judgement  are  clearly  indicated  in  the  c urves 
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presented  In  Reference  13.  Figure  3  show*  the  expected  growth  In  passengsr- 
mile#  per  year  for  aivil  arlation.  The  predicted  value  for  the  year  2000  la 
1.5  x  10^2.  Thie  prediction  represent*  a  50  percent  incrsauo  over  the  value 
predicted  five  yeare  earlier  on  Figure  1  of  Reference  39.  Figure  6  of 
Reference  13  (published  in  1962)  predict*  an  average  aircraft  apeed  of  leas 
than  3C0  apt  eau  average  paeaengero  per  aircraft  of  leee  then  50  for  the 
year  1967.  This  should  be  cospared  to  the  $00-600  mph  Jets  currently  in 
service  carrying  as  many  me  200  passengers.  The  speed  projected  for  the  year 
2000  ie  400  sph  which  will  certainly  fall  far  short  of  the  speed  of  the 
projected  SST'a.  Likewise,  the  year  aOOO  figure  of  60  passengers  per  aircraft, 
will  be  far  short  of  the  500  or  more  expected  for  the  "Junto  Jets'1  currently 
under  development .  The  use  of  such  figures  as  tha  basis  for  formulating  the 
desired  reliability  could  certilnly  be  questioned.  The  problem  ie  clearly 
recognised  in  Reference  39  where  it  is  stated  that  "'past  experience '  —  so 
often  referred  to  in  airworthiness  discussions  —  ie  in  feet  of  minor  signi¬ 
ficance  or  guidance,  at  least  in  statistical  analyses  and  predictions."  It 
goes  on  to  say  "tha  fact  that  a  design  'has  proven  to  be  satisfactory'  during 
even  a  considerable  service  life  is  by  itself  not  a  sufficient  proof  that  it 
will  rapreeent  a  satisfactory  safety  standard  for  the  future." 

Predictions  of  the  type  Just  dismissed  have  one  advantage  over  most 
of  the  elements  in  a  typical  structural  reliability  analysis.  The  figures 
can  be  verified  periodically.  This  provides  a  sound  basis  for  updating  the 
prediction.  The  discipline  of  being  subjected  to  eventual  verification  can 
be  expected  to  result  in  better  analytical  procedures  for  such  predictions. 
Many  of  the  structural  reliability  analyses  are  not  subject  to  t  his  sans 
discipline. 

The  "Allocation  of  Probability  Shares"  or  APS  is  presented  in 
Reference  13  as  a  statistical  approach  to  the  safety  problem.  The  APS 
Method  starts  with  the  proposal  that  a  total  accident  rate  of  no 
more  than  one  in  two  million  flight  hours  is  the  goal.  The  number  was 
chosen  as  Just  described  on  the  basis  of  the  expected  operational  statistics 
for  1980  and  beyond.  Besides  the  problems  inherent  in  extrapolating  past 
experience  to  prediction  of  the  future,  the  derivation  of  the  reliability 
goal  is  based  on  the  questionable  assunption  that  the  failure  rate  is 
linearly  related  to  the  hours  of  flight  operation.  There  is  considerable 
evidence  to  the  contrary.  Many  of  the  structural  failures  in  the  past  have 
been  the  result  of  an  unknown  design  deficiency  that  existed  at  the  time 
of  the  introduction  of  a  new  design  into  service.  Subsequent  events 
disclosed  the  error  which  was  corrected  after  which  that  type  of  failure 
never  recurred  during  the  life  of  the  particular  vehicle.  References  22 
and  40  document  a  number  of  such  problems.  After  describing  the  initial 
problems  and  their  solutions  for  two  well-known  transports,  Serllng  says 
in  Reference  22  that  they  "since  have  earned  a  fine  reputation  for 
dependability  and  safety."  Speaking  of  a  third  design  that  experienced 
fatigue  failures,  Serling  says  that  today  the  airplane  is  "rated  by  pilots 
as  one  of  the  best  short-range  transports  ever  built."  In  describing  the 
troubles  of  still  another  design,  Serling  identifies  the  reason  for  most 
of  the  Initial  troubles*  He  states :  "The  only  honest  answer  to  its  trouble 
la  that  it  was  tested  adequately  based  on  past  experience,  but  that  it  was 
not  tested  sufficiently  in  areas  where  there  had  been  no  previous  experience." 
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It  appears  that  the  statistical  model  for  failures  would  be  more 
rational  if  it  postulated  a  major  failure  probability  at  the  introduction 
of  each  new  design  and  a  minor  increment  associated  with  flight  hours 
accumulated  after  the  initial  problems  are  resolved. 

After  establishing  the  goal  for  the  total  failure  rate,  the  APS 
Method  allocates  portions  of  this  total  to  various  accident  causes.  In 
the  proposed  procedure  about  three  percent  of  the  total  is  allooated  to 
structural  failures.  Of  that  amount  about  ten  percent,  or  0.3  percent  of 
the  total,  is  allocated  to  fatigue  failures.  The  subdivision  is  carried 
further  by  allocating  subsharee  to  "oafe-life"  and  "fail-safe"  structural 
components  and  to  various  major  components  such  as  wing,  fuselage,  control 
ayatem  and  eqpennage.  Finally,  the  subdivision  is  extended  to  individual 
parte  in  each  cccgKment.  This  allocation  of  failure  rates  is  shown  on 
Figure  9  of  Reference  39.  Figure  11  of  Reference  13  shows  a  "probability 
cake"  divided  Into  pieces  allocated  to  each  individual  part. 

The  rationale  of  the  APS  Method  is  that  the  probability  of  failure 
of  each  part  is  statistically  independent  of  all  ether  part 3.  This 
aseungrtion  is  formalised  in  Equation  (l)  of  Reference  38  as  PR  =  2  P.,  . 

The  concept  is  carried  out  on  Figure  9  of  Reference  39  where  it  is  shown 
that  each  rf  "n"  parts  is  allocated  the  fractional  portion  of  l/n  of  the 
total  failure  rate. 

The  concept  that  the  probability  of  failure  is  the  summation  of  the 
individual  probabilities  is  very  conraon  in  structural  reliability  analyses. 
The  assumption  is  not  a  tenable  one  in  most  structural  situations.  The 
parts  are  not  independent  in  their  failure  mode.  Almost  all  external  loads 
imposed  cm  a  structural  system  result  in  internal  loads  on  all  of  the 
COBgJOnents.  Aa  a  result,  the  probability  of  failure  of  each  component 
must  bo  considered  a  conditional  probability.  The  conditional  probability 
^.s  expressed  as  the  probability  of  failure  of  the  part  given  that  all  the 
other  parts  have  survived.  A  simple  example  that  makes  the  conditional 
reliability  assumption  plausible  can  be  presented.  Got.  der  a  chain 
subject  to  the  random  loading  distribution  shown  on  Figure  24*  If  the  links 
in  the  chain  have  a  zero  coefficient  of  variation  in  strength,  every  link 
will  fail  at  the  same  load.  Thus,  If  the  links  are  designed  for  a  load 
corresponding  to  150  on  Figure  24,  the  probability  of  failure  of  the  chain 
is  10"3  no  natter  how  many  links  in  the  chain.  If  more  than  one  link  is 
considered,  the  increment  due  to  each  additional  link  is  zero.  The 
probability  of  failure  of  all  links  is  zero  balcw  a  load  of  150.  The  first 
link  has  a  10“3  probability  of  failure,  all  at  150.  But  the  second  link 
haa  a  zero  probability  of  failure  at  u  load  beyond  150  because  the  first 
link  has  zero  probability  of  surviving  beyond  150.  The  same  is  true  for 
any  number  of  additional  links. 

By  the  assunptian  of  Iumdbarg  and  others,  a  10,000  link  chain  would 
require  that  each  link  have  a  probability  of  failure  of.  10”3/n  or  10-7. 
From  Figure  24  tills  would,  require  that  each  link  be  designed  for  a  184 
percent  load.  In  such  a  case,  no  links  would  fail  at  150  percent  or  until 
the  load  reached  I84  percent.  Since  the  probability  of  this  load  is  10“7( 
the  probability  of  failure  of  the  10,000  link  chain  would  be  10-7  instead 
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of  the  expected  10"  3.  Figure  9  of  Reference  3  shown  that  the  proportional 
increase  in  probability  of  failure  with  number  of  components  is  the  exception 
rather  th*n  the  rule. 

These  two  rather  questionable  assumptions  on  two  major  problem  areas, 
taken  with  the  impossibility  of  measuring  the  actual  structural  reliability 
(which,  if  available,  would  in  icsalf  be  self- correcting  for  the  other  two 
problems),  lead  to  the  general  conclusion  that  Ittndbsrg's  APS  Method  asist 
be  considered  to  be  Impractical  for  the  design  of  aeroaps.ee  vehicles. 

Evaluation  of  landberg's  procedure  by  the  standards  listed  in  Section  4.3 
results  in  the  following  conclusions: 

1.  The  approach  defines  the  Desired  State  as  a  total  accident 
rate  of  less  than  one  in  two  million  flight  hours.  This 
value  is  not  unreasonable  for  the  cotsaercial  transports 
considered.  However,  the  particular  value  was  derived 
from  extrapolations  of  past  trends  that  are  questionable 
to  the  point  where  use  of  the  rate  proposed  any  not  be 
acceptable  in  the  foreseeable  future.  The  allocation  of 
thic  basic  failure  rate  to  individual  parts  in  inverse 
ratio  to  the  number  of  parts  cannot  be  justified 
statistically. 

2.  The  procedure  encounters  the  same  difficulty  as  other 
conparable  methods  in  determining  the  Actual  State  of  the 
structural  system. 

3.  As  a  result  of  the  lack  of  provision  for  measuring  the 
Actual  State,  the  procedure  Mill  be  incapable  of  any 
early  disclosure  of  possible  discrepancies  between  the 
Desired  State  and  the  Actual  State. 

(7)  Freudenthal 


In  Reference  15  Freudenthal  presents  the  results  of  applying  a  theory 
“  reliability  estimation  developed  in  References  41  and  42.  Since 
..aferenee  15  summarises  the  approach,  the  critique  will  be  based  principally 
on  it  with  occasional  mention  of  the  other  papers.  The  analysis  of  ultimate 
strength  and  fatigue  strength  are  presented  separately,  eo  they  will  be 
evaluated  in  the  same  way.  However,  it  should  be  noted  that  there  is  really 
no  sharp  line  of  demarcation  between  the  two  modes  of  failure.  Reference  42 
points  out  that  "tdiile  the  first  mode  is  usually  referred  to  aa  'ultimate 
load  failure'  and  the  second  as  'fatigue  failure,'  the  latter  is  in  essence, 
also  an  ultimate  load  failure  but  one  involving  a  fatigue-damaged  structure..,. 

(a)  Ultimate  Load  Failure 

The  procedures  for  ultimate  load  failure  as  described  in  Freudenthal 's 
papers  are  basically  comparable  to  those  proposed  in  Reference  11.  A 
detailed  examination  of  these  papers  shows  essentially  the  same  points  for 
consideration  that  were  discussed  in  the  evaluation  of  Reference  11.  The 
five  points  noted  on  pagt  v»  are  applicable  to  Freudenthal' a  proposed  proce¬ 
dure. 
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Although  it  la  not  at* tad  ilicitly,  thara  ia  an  Illicit  assumption 
in  Rafaranea  15  that  the  at  rang  and  load  distributions  arc  Touara, " 
presumably  aa  a  raault  of  anal'  jal  calculations.  Sections  II  and  III 
rl n rmmant  tha  fast  that  thaaa  t?  .ributions  are  not  known  after  an  analysis 
to  tha  accuracy  required  to  d-  ermine  structural  reliability. 

It  ia  a  well-known  scientific  principle  that  verification  of  a  hypoth- 
aais  ia  a  vital  el  tenant  in  th.,  sciantific  approach.  Figures  18  to  21 
document  tha  problem  in  the  framework  of  Professor  Draper's  technique.  The 
figures  show  that  in  a  Purely  Statistical  Structural  Reliability  System  the 
only  measure  of  the  Actual  State  of  the  Structural  reliability  of  a  vehicle 
ay ataai  is  ta  the  analytical  desips  «tege.  This  is  demonstrably  inadequate 
for  the  detorndnatlon  or  measursaenl  of  the  Actual  State.  Therefore,  any 
atructural  reliability  procedure  that  depends  on  analysis  alone  oust  be 
considered  to  be  an  wnaccsptable  solution  to  the  problem. 

Reference  15  takas  up  ths  question  of  the  statistical  definition  of 
flight  loads.  In  Sections  2  and  4  and  on  Tables  1,  2  and  4  of  Reference  15 
specific  recommndations  for  the  calculation  of  loads  distributions  used  in 
the  reliability  calculations  are  presented.  It  Is  a  virtual  certainty  that, 
if  this  procedure  for  calculating  load  spectra  is  followed  by  other  analysts, 
the  resulting  loads  spectra  will  not  always  be  sufficiently  accurate  to 
reeult  in  vehicle  designs  that  will  always  have  the  desired  structural 
reliability.  Sections  II  and  III  discuss  some  of  the  problems  of  calcu¬ 
lating  loads  and  loads  spectra. 

As  a  specific  example  of  how  different  analysts  will  arrive  at 
different  answers  to  the  same  problem,  consider  the  differences  between 
the  determination  in  Reference  15  and  that  in  Reference  29  of  the  probability 
of  exceeding  a  given  gust  velocity.  Reference  15  presents  some  analytical 
results  in  Figure  1.  There  is  no  mention  of  low-level  turbulence  or  of  the 
effects  of  climb,  cruise  and  descant.  However,  Reference  29  finds  that  each 
of  these  parameters  has  a  significant  influence  on  the  gust,  velocity  spectrum. 
Figure  5  of  Reference  30  shows  a  gust  velocity  exceedance  curve  that  is 
substantially  different  from  that  in  Reference  15.  It  is  interesting  to  note 
that  neither  author  mentions  a  problem  that  is  currently  of  major  concern  in 
the  design  of  high-speed,  high-flying  aircraft :  CAT,  or  clear  air  turbulence. 

The  point  of  all  this  is  that  different  analysts  will  arrive  at  different 
solutions  to  the  same  problem.  The  sams  analyst  may  arrive  at  different 
answers  before  the  vehicle  is  designed  than  he  will  after  it  is  in  operation 
and  he  has  the  benefit  of  hindsight.  Therefore,  it  must  be  accepted  that 
the  analytically-determined  load  spectrum,  on  which  hangs  such  of  the 
validity  of  the  structural  reliability  calculation,  is  not  a  known  spectrum. 

A  major  problem  in  the  definition  of  atructural  design  criteria  is  how  to 
make  deterministic  decisions  affecting  the  structural  design  in  the  face 
of  such  uncertainty. 

Another  difference  between  the  approaches  is  in  their  treatment  of  the 
dynamic  response  problem.  Reference  15  does  not  consider  it  and  Reference  29 
finds  it  vital  to  the  procedure.  In  effect,  the  response  considered  in 
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Reference  15  la  tha  force,  nW,  applied  to  tha  total  vehicle.  Along  with 
thia  definition  of  vehicle  reaponae  is  the  implicit  aeeunpticn  that  the 
vehicle  failure  can  be  defined  in  the  aij^le  terns  of  nW.  It  appears  that 
thia  is  an  overaiapllfied  aa sumption  that  would  result  in  erroneous  predic¬ 
tions  of  whan  failure  occurs  and,  thus,  of  the  probability  of  failure. 

A  simple  but  well-known  example  of  how  the  response  may  play  a  major 
role  in  determining  whan  failure  occurs  can  be  seen  in  a  design  with  a 
store  at  the  wing  tip.  The  shear  and  torque  may  be  very  critical  compared 
to  the  magni*'  ’de  of  the  root  banding  moment.  Also,  the  bending  moments 
in  the  wing  near  the  tip  may  be  in  the  opposite  direction  from  those  near 
the  root  of  the  wing.  It  is  dubious  that  the  simple  nW  function  could 
represent  the  failing  conditions  on  such  a  wing. 

Some  of  the  detail  assumptions  made  in  the  calculation  of  failure 
rates  for  the  comparison  on  Table  5  of  Reference  15  may  be  adequate  for 
demonstration  purposes  but  would  be  rather  questionable  in  predicting  the 
characteristics  of  future  vehicles.  A  parametric  study  of  the  effect  of 
the  gust  sensitivity  factor,  k^,  is  presented  on  Figure  14*  Since  k^ 
increases  with  forward  velocity,  the  curve  would  apparently  show  that  the 
critical  (down)  probability  of  failure  decreases  with  increased  airspeed. 
This  is  contrary  to  the  true  situation.  The  probability  shewn  on  Figure  14 
is  based  on  the  unspecified  assumption  that  the  strength  is  increasing 
along  with  the  airspeed  and  k^.  For  a  down  gust,  the  effect  of  the  1.0  g 
level  flight  load  factor  on  tne  total  load  factor  is  such  that  the  gust 
velocity  corresponding  to  1.5  times  the  larger  limit  nW  will  be  larger. 

The  probability  of  exceeding  this  larger  gust  velocity  is  less  which  is 
the  basis  for  the  unexpected  decrease  in  probability  of  failure  as  airspeed 
increases. 

After  the  parametric  study  is  made  using  four  values  of  kn,  one  of  the 
four  is  selected  to  determine  the  failure  rate  shown  on  Table  5.  The 
estimated  14  gusts  per  mile  is  a  constant  whereas  Reference  29 
forrmlates  the  number  of  responses  per  second,  N0,  a3  a  function  of  the 
dynamic  response  among  other  things.  In  fact.  Reference  31  notes  that  N0 
will  increase  with  the  addition  of  a  stability  augment er.  Reference  15 
then  assumes  an  average  cruising  speed  of  200  miles  per  hour  to  determine 
the  average  number  of  gusts  per  hour.  There  is  no  indication  of  how  this 
average  velocity  for  all  aircraft  operating  over  a  15-year  period  is 
determined  or  hew  it  would  be  estimated  for  a  new  design. 

It  is  almost  axiomatic  that  no  load  spectrum  analysis  by  itself  can 
support  a  structural  reliability  calculation  as  necessary  to  insure  very 
high  reliabilities.  The  discussion  of  the  formulation  of  the 
loading  distribution  indicated  the  analysis  was  no  exception  to  the  rule. 
Unless  there  is  some  procedure  for  validating  the  spectra  predicted  by 
analytical  neans,  the  structural  reliability  calculation  will  be  just  an 
exercise.  The  ultimate  strength  distribution  is  formulated  in  sections  3 
and  4  and  Table  4  of  Reference  15.  The  same  statements  made  relative  to 
the  accuracy  of  the  load  distributions  are  applicable  to  the  strength 
distribution.  Sections  II  and  III  discuss  some  of  these  problems.  The 
discrepancy  between  calculatod  strengths  and  actual  strengths  as  documented 
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in  Reference  17  is  the  major  probls*.  Some  detail  problems  relative  to  the 
strength  distribution  calculations  recommended  in  Reference  15  ara  considered 
in  the  discussion  following. 

Tha  ganaraliiad  probability  distribution  for.tha  strength  chosen  by 

a  a  vauwiwucM.  ap  ga  u  taaoua  awuwauu  ug  uux  a«  3&  at  mwuwi  tuata  *■ 

nothing  wrong  with  such  a  choice  over  tha  central  range  of  tha  data,  but 
Referer.ee  15  considers  it  to  ha  unaccepted  »  for  extrapolation  below  80 
percent  of  the  user,  value.  As  a  result,  a  log-nonaal  distribution  is  intro¬ 
duced  below  the  90  percent  value.  The  resulting  forwlaticn  as  equation  3*6 
is  nsither  nore  nor  L  's  justifiable  in  the  region  near  the  mean  than  other 
distributions  such  as  normal,  log-normal  or  Weibull.  A  fundamental  question 
raised  by  such  manipulations  is  the  arbitrary  manner  in  which  the  choice  is 
made.  It  renders  very  questionable  the  probabilities  of  failure  presented 
in  Reference  15  on  Figures  9  through  18  which  range  from  1C r4  to  10~^2.  This 
is  not  a  problem  in  this  formulation  alone;  it  is  common  to  any  reliability 
analysis  of  this  type.  After  all,  it  is  hard  to  justify  mathematically  a 
10-12  prediction  based  on  the  170  data  points  represented  on  Figure  7* 

Taylor  (quoting  Lusser)  on  page  286  of  Reference  35  has  pointed  out  that  a 
rule  of  thumb  for  "the  number  of  specimens  required  to  estimate  the  chance 
of  failure  is  ten  times  the  reciprocal  of  the  chance."  This  would  require 
a  minimum  of  10*  data  points  and  possibly  as  many  as  10^3  data  points  to 
substantiate  the  curres  of  Figures  9  through  18. 

A  more  meaningful  objection  to  the  suggested  strength  distribution 
is  in  the  normalizing  process  used  to  arrive  at  Figure  7  and  Equation  3.6. 

The  result  of  this  manipulation  is  that  there  is  built  into  the  analysis 
an  implicit  assumption  that  all  structures  have  the  same  coefficient  of 
variation  in  strengths  (y  ),  namely  0.05638.  Table  3  shows  a  range  of 
sample  coefficients  from  0.0149  to  0.0994,  just  for  the  limited  amount  of 
data  Freudenthal  reviewed.  It  can  be  shown  that,  if  the  hypothesis  were 
true,  it  would  be  very  unlikely  (something  of  the  order  of  a  probability  of 
10~6)  that  the  distribution  shown  on  Table  3  would  result.  Future  designs 
are  expected  to  involve  brittle  materials,  large  shells  falling  in  buckling 
and  material  operating  near  the  upper  limit  of  its  temperature  capability 
which  are  known  to  have  coefficients  of  variation  up  to  0.25  or  0.30.  This 
assumption  of  an  average  Ya  eliminates  any  consideration  of  the  powerful 
effect  this  function  has  on  the  true  reliability  as  shown  in  the  discussion 
accompanying  Figure  23  and  previously  in  References  4  and  5- 

The  stated  reason  for  truncating  the  "t"  distribution  at  80  percent 
of  the  mean  value  snould  be  examined  carefully  because  of  its  significance 
in  establishing  structural  design  criteria.  On  page  15  of  Reference  15  it 
Is  stated  that  the  "t"  distribution  can  be  truncated  at  the  80  percent 
value  "on  the  quite  justifiable  assumption  that  structures  of  lewer  strength 
will  be  eliminated  by  inspection  during  manufacture."  It  is  indisputable 
that  this  is  a  goal  of  inspection  but,  unfortunately,  the  facts  of  the 
situation  are  different.  Many  cases  of  failure  at  less  than  limit  conditions 
can  be  documented  for  both  aircraft  and  space  vehicles.  These  underetraogth 
situations  stem  from  two  causes.  First,  the  basic  design  may  be  in  error  so 
that  a  structure  fabricated  in  exact  accordance  with  the  drawings  and 
specifications  may  fail  prematurely.  The  failure  of  the  Mariner  3  shroud 
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1*  typical  of  *  no tor  of  failures  associated  with  a 

dsiitfi  orroTjVf  Porfoct  inspection  could  not  changa  this  situation. 

Second,  inspection  procedures  do  not  always  reject  structures  fabricated 
outside  tha  tolerances  called  for  on  tho  drawings  and  apoolfleationa. 

During  World  War  11  a  troop-carrying  glider  railed  eaiwrophloariy  &*£•&•« 
a  critical  dimension  on  a  wing  strut  fitting  was  lass  than  20  parosnt  of 
tho  specified  diaantion  on  the  drawing  of  the  part.  It  has  boon  reported 
that  tho  ongtns  support  truss  on  an  early  opaoe  vehicle  failed  because 
the  wall  thickness  of  one  of  the  tubes  was  about  one-half  the  designated 
glee.  Inspection  could  have  detected  and  prevented  these  two  failures  but  , 
for  tone  reason  they  were  accepted  for  operation.  These  are  just  three  of  [ 
the  many  Instances  of  prenature  failure,  spanning  the  period  from  simple 
aircraft  to  complex  space  vehicles,  that  could  be  documented. 

The  fact  that  failures  occasionally  occur  due  to  understrength 
situations  does  not  mean  that  such  failures  are  as  acceptable  as  failures 
due  to  operating  beyond  the  specified  limit  conditions.  In  Reference  3 
It  is  suggested  that  a  goal  of  structural  design  criteria  should  be  to  have 
no  acre  than  one  percent  of  the  total  number  of  failures  occurring  at  limit 
conditions  or  less.  This  would  furnish  the  basis  for  quantifying  require— 
msnts  associated  with  Halt  conditions  which  is  not  available  in  the 
foraalation  of  the  problem  in  Reference  1$. 

/ 

In  the  formulation  of  the  reliability  calculation  on  Table  4  of 
Reference  15,  the  mean  value  of  the  strength  is  assumed  to  be  (l)  at  a 
load  corresponding  to  the  ultimate  load  (P  =  0.5)  or  (2)  at  a  load  correspond¬ 
ing  to  1.056  times  the  ultimate  load  (P  =  O.l)  since  the  reciprocal  of 
Or,P  =  0.947  is  1.056.  The  justification  for  the  P  =  0.1  assumption  is 
discussed  on  page  26.  It  refers  to  data  showing  that  10  percent  of  the 
spedmans  give  values  below  the  specification  mini  mum.  These  data  are  con¬ 
tained  in  Reference  46.  The  data  in  question  appear  to  be  for  civil 
engineering  materials  such  as  mild  steel  end  concrete.  On  the  other  hand, 
tha  "A"  allowables  which  correspond  to  the  specification  values  are  intended 
to  be  99-percant-axeeed  values .  All  indications  are  that  the  material 
furnished  by  the  mills  end  accepted  by  the  inspection  departments  of  major 
contractors  is  substantially  better  than  the  mini  mm  specification  value 
for  more  than  99  percent  of  the  specimens.  The  Justification  for  the 
P  =  0,5  assumption  is  the  fact  that  there  is  normally  only  one  strength 
test  to  destruction.  However,  Reference  17  shows  that  43  percent  of  the 
wings,  50  percent  of  the  fuselages,  82  percent  of  the  horizontal  stabilisers, 
86  percent  of  the  vertical  stabilisers  and  78  percent  of  the  landing  gears 
supported  the  ultimate  load  without  failure  on  the  first  teat.  Modification 
resulting  from  tho  test  failures  resulted  in  all  of  the  structures  possessing 
at  least  the  design  strength  with  many  having  more  strength  than  required. 

It  appears  that  the  average  structure  is  5  to  10  percent  above  the  required 
strength  value  after  successful  completion  of  the  tests. 

It  appears  that,  regardless  of  where  the  average  structural  strength 
ends  up  in  practice,  it  is  unwise  to  deliberately  design  the  structure  so 
that  50  percent  of  the  structures  will  fail  before  the  test  load  is  reached. 
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Nbo  errors  of  tha  type  documented  is  Refsr-sjee  1?  ire  added  te  tns  twtnH1* 
cal  expectation,  thenunfeer  of  test  failures  necessitating  redesign  would 
increase  to  the  point  where  costs  of  redesign  and  schedule  delays  would  bo 
intolerable. 

In  the  formulation  of  the  aquation  for  tha  probability  of  failure  on 
Table  4  of  Reference  15  and  in  the  discusaione  of  Section  4*  there  is  an 
unstated  assueption  that  failure  of  the  airplano  is  defined  by  nW,  This 
is  incorrect  in  laany  instances.  Sobs  that  relate  to  the  local  loads  were 
discussed  In  the  section  on  loads  distribution.  Others  involve  the  fact 
that  each  component  is  designed  to  survive  a  nuafear  of  critical  loads. 

Che  of  these  will  be  critical  and  the  coupon emt  will  have  excess  strength 
for  all  others.  Furthermore*  there  is  an  inherent  assumption  that  is  often 
incorrect  In  assuming  that  the  local  coupon ent  loads  are  linear  beyond  the 
limit  conditions.  At  best,  the  choice  of  nW  as  the  controlling  function 
for  failure  can  only  give  a  crude  approximation  of  the  true  situation. 

The  integration  of  the  load  and  strength  distribution  to  calculate  a 
probability  of  failure  is  quite  straightforward  as  given  in  Equation  4.7; 
However,  as  discussed  in  Sections  U  and  III,  the  probability  of  failure 
calculated  using  the  distributions  assumed  with  no  considerations  of 
analytical  errors  may  be  several  orders  of  nagnitude  better  than  the  true 
value.  Figure  23  in  the  Austin  discussion  presents  ecssa  data  on  this  problem, 
which  is  tha  major  problem  in  actually  predicting  the  probability  of  failure. 

Table  5  of  Reference  15  shows  tha  comparison  of  failure  rate  between 
actual  values  and  those  predicted  by  the  proposed  method.  The  comparison 
is  in  tanas  of  failure  rate  per  hour.  This  implies  that  there  is  a  direct 
correlation  between  hours  flown  and  number  of  failures.  Although  such  an 
assumption  is  made  by  many  authors  in  the  field  of  structural  reliability, 
the  assumption  is  unproven  and  it  is  open  to  serious  question.  In  the 
discussion  on  page  1D3  the  thesis  is  developed  that  the  major  failure  prob¬ 
ability  is  associated  with  the  introduction  of  each  n m  design.  The 
inerttment  associated  with  flight  hours  appears  to  be  a  minor  portion  of  the 
total  failure  rate. 

Data  are  presented  in  the  form  of  probability  of  failure  per  gust  in 
Figures  9  to  14  of  Reference  15.  As  discussed  under  the  Austin  evaluation, 
it  is  not  apparent  that  this  is  a  conditional  reliability.  Consequently, 
these  numbers  require  another  number  to  make  them  meaningful.  Accordingly, 
it  is  suggested  that  such  data  be  presented  in  terms  of  probability  per 
vehicle  lifetime  to  enhance  its  usefulness  in  the  design  process. 

The  statement  is  made  on  page  43  of  Reference  15  -hat  "the  majority  of 
structural  failures  are  at  structural  reaistances  neai  the  mean.*  This 
question  has  becu  discussed  before.  It  should  be  pointed  out  in  this 
connection  that  the  statement  is  critically  dapeudent  on  the  qualification 
attached  to  the  atatmaant  *  It  is  indicated  that  this  assumes  the  (email) 
scatter  in  structural  resistance  presently  achieved  in  production.  The 
assumption  is  correct  only  if  the  scatter  end  the  mecn  are  as  assumed. 
Sections  II  end  HI  indicate  that  errors  In  analysis  are  frequent  enough  to 
invalidate  this  assumption.  Furthermore,  there  Is  every  indication  that  the 
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itrwtwM  of  ths  future  ar  not  be  able  to  maintain  the  —oil  scatter 
unm d.  The  Increasing  a—  of  brittle  materials,  extr  *1 y  high  tapor** 
twee*  — d  more  critical  buckling  problems  1a  very  largo  shell  structure* 
all  indicate  that  dodders  may  bo  forced  to  uoo  structures  with  largo 

StnBgtt  !h  ww  SiSii  *  t hi  pr^wTuliiS  vT  filLifvi  it  TilSSS 

appreciably  below  tho  —ass  will  incre***. 

Ob  page  54  of  Reference  43*  tho  irrationality  of  tho  “belief  that 
reliability  figaras  of  tho  ordor  of  0.99*  0.999*  or  0.9999  can  bo  taken  at 
tholr  faea  value  with  reepect  to  larga  structures"  la  pointed  out. 
(fcforUmately,  structural  design  criteria  and  its  implementation  in  a 
structural  daaign  ayat—  da— nda  that  yea-or-no  dociaiona  bo  Bade.  If  % 
structural  reliability  require— nt  is  established  as  the  criterion*  there 
—at  be  a  procedure  to  serve  es  proof  of  co*pli*nce. 

The  approach  to  the  probl—  of  structural  reliability  against  ultimate 
load  failures*  as  presented  in  Reference  15  et  el.,  la  e  —  Jor  contribution 
to  the  develop— nt  of  the  reliability  concept  as  a  useful  tool  of  design. 
However*  there  aro  two  major  shortcomings  in  this  approach.  First,  even 
though  the  reliability  figures  cannot  be  taken  et  face  value*  this  is  dons 
when  It  is  — so— d  that  the  load  and  strength  probabilities  are  known.  This 
assumption  overlooks  the  possibility  that  there  may  be  errors  end  discrep¬ 
ancies  in  the  calculations .  Second,  the  procedure  allows  no  recognition  of 
the  need  to  disclose  the  potential  errors  with  e  certainty  that  is  consistent 
with  the  desired  reliability.  As  a  result,  there  is  no  proof  of  coopllance 
procedure  that  is  a  necessity  if  the  proposed  procedure  is  to  fulfill  the 
need  fur  a  practical  procedure  that  can  be  incorporated  into  contractual 
require— nts. 


(b)  Fatigue  Failure 

The  analysis  of  structural  reliability  under  fatigue  conditions  is 
presented  in  many  reports  such  as  References  15  and  41  through  44.  The 
approach  to  tho  determination  of  the  probability  of  failure  in  fatigue  is 
—  extension  of  tho  approach  developed  for  ulti—te  failure.  The  same 
two  abort  comings  that  are  present  in  determining  the  load  and  strength 
distribution*  are  present  in  the  fatigue  analysis.  In  addition,  the  problem 
of  determining  the  strength  distribution  after  any  given  time  or  nueber  of 
applied  loada  adds  additional  opportunities  for  the  actual  strength  dis¬ 
tribution  to  depart  from  the  calculated  distribution.  References  15  end  41 
through  44  give  no  recognition  of  the  need  to  disclose  the  potential  errors 
with  a  high  degree  of  certainty  and  no  provision  for  a  proof-of-co^>liance 
procedure.  This  is  the  basic  probl—  from  which  stem  all  other  problems 
affecting  the  calculation  of  fatigue  reliability.  Soso  of  the  detail 
problems  are  evaluated  in  the  discussions  following. 

Reference  15  presents  a  discussion  o  '  fatigue  reliability  but  it  does 
not  set  forth  a  specific  procedure  that  could  be  used  in  the  ab  initio 
design  of  aerospace  vehicles.  There  is  no  procedure  for  calculating  the 
structural  reliability  for  any  given  nuafeer  of  hours  of  operation  or  for 
the  vehicle  lifetime.  The  analysis  that  is  presented  is  essentially  based 
on  mqpl:.lcal  data  that  would  not  be  applicable  to  other  designs.  For 
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Instance,  the  data  on  heary  bomber  aircraft  consists  of  a  record  of  the 
service  experience  of  40  aircraft  from  the  fleet.  The  time  whan  a  crack  was 
discovered  daring  an  inspection  was  tabulated  on  Table  6.  These  data  were 
converted  Into  the  probability  distribution  presented  in  Figure  19.  Froai 
this  the  mean  life  to  Initial  crack  was  determined  to  be  1970  hours.  Then, 
on  page  40  it  was  noted  that  "a  crack  propagation  period  of  60JC  of  the  total 
life  seems  realistic  for  the  well-defined  initial  failure  considered  here. 
This  provides  an  approximate  estimate  of  5,000  hours  for  the  life  to  final 
failure. "  This  estimate  can  be  seen  to  stem  from  recorded  data  of  operations 
not  available  during  the  design  stage  of  a  new  vehicle.  The  relationship  of 
the  time  to  initial  failure  to  the  time  to  final  failure  appears  to  be 
based  on  the  assumption  that  the  crack  propagation  period  is  60%  of  the 
total  life.  Tho  uncertainties  associated  with  the  determination  of  this 
ratio  can  be  best  illustrated  by  the  fact  that  on  the  same  page  a  crack 
propagation  time  of  20%  is  suggested  for  fighter  aircraft  without  any 
justification  being  pros  anted  for  the  two  different  makers. 

The  remainder  of  the  analysis  in  the  fatigue  section  in  Reference  15  is 
devoted  to  the  determination  of  fatigue  sensitivity  which  is  defined  as 
ratio  of  the  risk  of  a  fatigue  failure  under  N  loads  to  the  risk  of  ultimate 
failure.  Reference  43  states  that  the  risk  function  "plays  an  Important  role 
In  statistical  analysis  of  fatigue  failures."  Equation  (4)  of  Reference  41 
defines  reliability  as  a  function  of  the  integral  of  the  risk.  However,  the 
analysis  presented  in  Reference  15  illustrates  soma  of  the  perils  of  a 
statistical  approach  that  is  dependent  on  analysis  alone.  A  non-dimensional 
f  emulation  of  the  fatigue  sensitivity  is  presented  on  page  41  of  Reference 
15.  The  calculations  are  presented  on  Table  7  and  on  page  47  it  is  stated 
that  the  "life  NQ  for  equal  risk  of  ultimate  and  fatigue  failure  has  been 
estimated  as  960  hours."  It  does  not  seem  consistent  with  known  facts  to 
arrive  at  such  a  number.  It  appears  that  the  population  defined  in  equation 
5.5  is  not  the  same  as  the  population  defined  for  the  risk  of  fatigue 
failure,  (N) ,  when  H  —  0.  This  view  is  supported  by  Freudenthal ' s  other 
papers.  Table  II  of  Reference  42  shews  that  the  fatigue  sensitivity  factor 
is  always  equal  to  or  greater  than  1.0.  likewise  cm  page  64  of  Reference  43 
it  is  noted  that  Pp  >  Py.  Then,  it  is  stated  that  the  risk  function  ru(N)  is 
therefore  not  a  constant  but  increases  with  N.  Therefore,  it  appears  that 
there  is  a  contradiction  in  the  analysis  of  the  fatigue  reliability  as 
presented  in  the  two  separate  papers.  The  discrepancy  per  se  is  not  the 
basic  problem.  The  basic  problem  is  that  such  discrepancies  may  be  expected 
to  occur  from  time  to  time.  If  there  is  no  quantitative  procedure  to  verify 
the  numerical  values  as  confuted  by  different  analysts,  there  ie  no  way  to 
administer  a  structural  reliability  requirement  by  deciding  that  any  given 
design  does  or  does  not  comply  with  a  specified  reliability  requirement. 

It  is  suggested  that  in  addition  to  the  lack  of  recognition  of  the 
probability  of  errors  in  the  analysis  there  is  another  fundamental  weakness 
in  the  formulation  of  the  structural  reliability  problem.  This  weakness 
resides  in  the  abandonment  of  R/S<1.0  as  a  definition  of  failure.  Adoption 
of  the  "return  period"  or  "life"  as  the  basic  parameter  defining  the  struc¬ 
tural  reliability  clouds  the  issue.  The  issue  in  question  is:  how  likely 
to  fail  is  a  vehicle  that  is  operating  "now";  not  will  that  vehicle  fail  at 
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some  far  distant  time  which  it  is  not  intsndsd  to  approach.  This  Is  not  a 
eass  of  ssaanties,  hot  se— thing  of  fnnda— ital  significance. 

Reference  41  on  page  21  Initially  daflnss  failures  as  R/ S<1.0.  This 
•imply  states  the  fact  that  failure  occurs  when  the  load  applied  is  greater 
than  the  available  strength.  This  verity  is  applicable  at  the  beginning  of 
the  structural  life,  at  all  interin  periods,  and  at  the  tins  of  actual 
failure.  In  the  fatigue  situation,  the  resistance  R  is  lower  than  the 
initial  strength.  As  stated  on  page  1  of  Reference  42  the  "fatigue  failure 
is,  in  essence,  an  ultiaate  load  failure,  but  one  involving  a  fatigue-damaged 
structure,  and  therefore  occurring  under  a  terminal  load  of  considerably 
lower  intensity...." 

This  principle  is  not  used  in  the  final  formula tion  which  reverts  to 
the  concept  of  "return  period”  or  "life”  as  parameters  that  determine 
failure.  Return  period  and  life  are  abstractions  that  have  never  caused  a 
failure.  There  is  en  Implicit  assumption  that  the  distribution  of  the  return 
period  or  life  defines  the  distribution  of  the  strengths  that  existed  at 
previous  times.  There  is  no  verification  of  this  Implicit  relationship  nor, 
in  fact,  is  there  a  recognition  that  the  relationship  needs  to  be  verified 
before  the  proposed  procedures  can  be  validated.  Vhon  the  relationship  is 
established,  it  will  be  possible  to  decide  what  the  successful  completion 
of  a  fatigue  test  to  a  specified  time  msens  in  relation  to  the  distribution 
of  strength  and  thus  the  reliability  at  some  lesser  time.  When  this  infor¬ 
mation  becomes  available,  a  rational  definition  of  the  proof  of  cospliance 
would  then  become  possible.  Until  then,  the  approach  will  be  another  form 
of  that  "sophisticated  deceit"  warned  against  an  page  65  of  Reference  43. 

Evaluation  of  Freud enthal’s  procedure  by  the  standards  listed  in 
Section  4.3  results  in  the  following  conclusions : 

1.  There  is  no  specific  recommendation  in  References  15  and 
41  through  46  for  a  quantitative  structural  reliability 
value  that  would  define  the  Desired  State  for  the 
structural  system  of  an  aerospace  vehicle.  Therefore  no 
judgement  can  be  formulated  on  the  application  of  Reference 
15  to  actual  vehicle  design. 

2.  References  15,  at  ai.,  discuss  exclusively  the  problem  of 
determining  the  structural  reliability,  probability  of 
failure,  or  the  fatigne  "life"  of  a  structure.  Reference 
43  acknowledges  that  the  computed  reliability  figures  cannot 
be  taken  at  face  value.  Thus,  they  could  not  be  used  to 
determine  the  structural  reliability.  The  Actual  State 

of  the  structure  could  not  be  determined  in  such  circumstances . 

A  comparable  problem  exists  for  the  fatigue  mode  of  failure. 

The  calculation  of  the  "return  period"  or  "life"  does  not 
define  the  probability  of  failure  during  the  actual  life 
of  a  vehicle.  Thus,  there  is  no  procedure  for  calculating 
the  reliability  during  the  operating  lifetime  of  the  vehicle. 

Also,  there  is  no  discussion  of  a  proof  of  compliance 
procedure  to  demonstrate  the  Actual  State  of  the  structure 
before  or  during  operation  of  the  vehicle. 
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3.  Sine*  there  It  no  Desired  State  specified  and  there  la  no 
provision  for  accurately  determining  the  Actual  State,  the 
procedure  cannot  furnish  information  for  deciding  whether 
any  given  atruetural  eyetwr  should  ba  accepted  or  redacted 
for  oparatlcne.1  usage: 

(8)  Other  Anthers 

The  seven  approaches  reviewed  in  the  previous  sections  represent  a 
good  cross  section  of  tha  Literature  on  tha  subject  of  quantitative 
structural  design  criteria  by  statistical  act  hods.  Thera  are  amry  other 
excellent  papers  available  on  tha  subject ,  but  space  prohibits  a  complete 
discussion  of  each  of  them  A  very  brief  consent  follows  on  a  number  of 
papers  known  to  be  of  Interest  to  the  structural  design  community. 

Diederioh,  at  ad.,  have  developed  the  structural  reliability  approach 
presented,  in  References  14  and  46  and  other  papers.  The  evaluation  of 
Section  3.4  and  those  of  the  papers  in  this  critique  such  as  Kluger  are 
applicable  to  Qiederich'a  approach.  Reference  46  introduces  the  Monte  Carlo 
aethod  to  the  procedure.  This  does  not  change  the  situation  since,  as 
Diederich  says,  "the  statistics  of  the  variables  mat  be  known."  Contrary 
to  the  opinion  of  sons,  the  Monte  Carlo  technique  adds  nothing  to  the  for- 
eolation  of  the  problem.  All  it  can  do  is  ease  the  solution  of  the 
particular  problem  formulated. 

Reference  48  introduces  the  concept  of  structural  optimisation  into  the 
analysis,  but  it  is  only  as  good  as  the  basic  formulation  of  tha  problem. 
Sections  II  and  III  indicate  that  an  analytical  calculation  of  probability 
of  failure  cannot  ba  considered  to  be  accurate  enough  to  serve  alone  as  the 
measure  of  tho  reliability  of  a  structural  system. 

In  Reference  49  Swltxky  present  e  a  method  for  "designing  coaponent 
masters  of  a  minimum  weight  structure  that  will  have  a  required  overall 
reliability."  Hilton  and  F eigen  in  Reference  SO  and  Ghista  in  Reference  51 
also  present  methods  for  minimising  the  weight  of  a  mlti-ccaponent 
atruetural  system  chile  achieving  a  designated  structural  reliability.  The 
optimisation  procedure  in  each  of  these  three  papers  depends  on  the  calcula¬ 
tion  of  a  structural  reliability  based  on  the  assumption  that  the  load  and 
strength  distributions  are  known. 

Pugsiey,  in  Reference  1,  presented  one  of  the  earliest  known  discussions 
of  the  statistical  approach  to  structural  design.  The  summary  of  this 
report  still  could  be  used  as  the  statesmnt  of  objectives  of  a  quantitative 
structural  design  criteria  based  on  statistical  methods.  It  states,  "This 
report  attempts,  in  a  preliminary  and  elementary  way,  to  bring  aeroplane 
structural  strength  and  loading  statistics  together  into  a  logical  and 
practical  philosophy  of  strength  factors.  By  correlating  such  statistics 
with  structural  accident  rate*,  the  influence  of  various  design  parameters 
is  demonstrated  and  a  new  view  of  some  past  difficulties  obtained. " 

Ten  der  lent.  In  Reference  52,  presented  oca  of  the  first  mathematical 
formulations  of  tha  probability  of  atruetural  failure.  Both  of  these  papers 
ware  outstanding  pioneering  efforts  end  should  be  recogni sort  as  such. 


However,  neither  recognised  the  problem  that  the  wd  or  calculated  load 
and  strength  distributions  ars  not  known  but  ars  subject  to  srrors  of 
various  magnitudes.  Also,  they  did  not  recognise  ths  nssd  for  a  proosdnrs 
to  measure  sad  verify  ths  calculations  that  rssult  In  a  decision  that  a 
particular  design  is  acceptable. 

b.  Modification  of  Present  (Factor  of  Safety)  Structural  Design  System 
(1)  Vagner 

In  Reference  28  Wagner  presents  a  brief  un—siji  of  the  procedures 
developed  during  an  Air  Force  contract  by  Wagner,  lands s,  Readey  and  other 
McDonnell  personnel.  The  complete  docn— tatlcn  of  the  study  is  presented 
In  Reference  10  by  Landes,  Wagner  and  Erlegshauser  and  in  Reference  9  by 
Readey.  Two  procedures  are  proposed,  (me  for  Imsedlate  use  and  another  for 
ispleeMntatlon  after  additional  development  and  the  collection  of  more  data. 
The  latter,  Readey' s  method,  was  previously  critiqued. 

The  procedure  recommended  In  Reference  10  and  summarised  in  Reference  28 
has  most  of  the  characteristics  of  the  Present  (Factor  of  Safety)  Structural 
Design  System  discussed  and  evaluated  In  Sections  U  and  III.  This  procedure 
is  considered  to  be  an  outstanding  and  pioneering  effort.  It  recognises  both 
directly  and  intuitively  many  of  the  vital  elements  of  a  practical  system  of 
structural  design  based  on  statistical  considerations.  It  ia  believed  that 
the  publication  of  this  method  is  the  first  time  anyone  has  seriously 
advocated  that  separate  and  distinct  factors  should  be  applied  to  each  of 
several  of  the  significant  parameters  affecting  structural  design. 

The  modified  safety  factor  approach  presented  in  Reference  28  inco;r- 
po rates  many  of  the  characteristics  outlined  in  Section  3.6  as  the  desirable 
features  of  a  structural  design  system.  In  particular,  the  procedure  retains 
the  deterministic  type  of  requirements  that  give  the  present  factor  of 
safety  system  its  practicality  and  administrability.  By  establishing  three 
separate  safety  factors,  this  procedure  has  recognised  that  each  significant 
parameter  affecting  the  structural  integrity  may  require  a  different  increment 
or  factor  for  design. 

The  fundamental  problem  in  this  procedure  is  the  same  one  identified  in 
Section  III  for  the  Present  Structural  Design  System.  There  is  no  clearly 
identifiable  objective  that  the  Present  System  and  the  system  proposed  in 
Reference  28  ia  expected  to  satisfy.  The  present  requirements  have  evolved, 
for  the  most  part,  as  a  reaction  to  past  problems.  The  Reference  28  proposal 
would  not  change  this  situation.  The  choice  of  1.05,  1.10,  and  1.15  as 
factors  to  apply  to  speed,  quality,  and  maneuverability  is  justified  Initially 
on  the  basis  that  the  resulting  design  approximates  that  which  would  result 
from  the  typical  missile  factor  of  safety  of  1.25.  As  Wagner  says,  "the 
proof  of  this  modified  approach  can  be  achieved  only  through  its  use."  This 
is  exactly  how  the  Present  System  has  evolved.  Cface  these  factors  were 
adopted,  they  would  not  be  changed  unless  some  future  failure  occurred  that 
indicated  an  inadequacy  in  the  requirement.  In  such  an  event,  an  ad  hoc 
decision  would  be  generated  to  define  the  change  required. 
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If  this  mum  procedure  were  to  bo  applied  to  Maned  aircraft,  the 
baalo  for  tho  choice  of  tho  throo  parameters  la  not  clear.  Sisco  all  classes 
of  aircraft  prop  ant  ly  require  tho  aaao  1.5  faetor  of  safety,  presumably  all 
would  haro  tho  aaao  throo  factor*  for  speed,  quality  and  maneuverability, 
owviir,  m  light  observation  plana,  a  fight  or  and  a  transport  probably  would 
not  require  tho  aaao  faetor  for  opood.  The  rations lo  for  choosing  dUleront 
values  would  ha v«  to  bo  defined. 

In  tho  propoeed  procedure  of  Reference  28  limit  loads  do  not  oodst.  If 
there  are  no  Halt  loads,  there  can  be  no  liadt  operational  oondtticne*  If 
such  is  the  case,  then  tharo  are  no  operational  limitations  that  can  be 
furnished  to  the  user  of  the  vehicle.  It  is  considered  that  the  eatabliahaont. 
of  a  co— on  point  of  reference  for  the  user  and  designer  is  vital  to  the 
success  of  the  Present  System.  Any  new  system  should  identify  explicitly 
the  crucial  interfaces  with  nan-structural  syeteaa.  It  should  sake  provision 
for  assigning  responsibility  for  every  function  that  affects  structural 
integrity.  The  limit  conditions  furnish  an  unequivocal  line  of  demarcation 
between  the  responsibilities  of  the  structural  system  designer  and  the 
vehicle  user.  Regardless  of  how  a  limit  condition  is  established.  It  is 
permissible  for  the  user  to  operate  up  to  that  Halt.  At  this  level  tho 
structural  system  should  be  safe  and  "never"  fail.  Above  the  limit  condition 
the  responsibilities  shift.  The  user  is  violating  his  stated  restrictions 
anywhere  above  limit  conditions  and  must  expect  that  failure  will  occur  if 
the  excursion  beyond  limit  becomes  very  largo. 

Figure  10  shows  how  limit  Design  Conditions  are  the  basis  for  Operational 
Limitations.  In  turn,  these  become  part  of  the  Operational  System  where 
they  play  a  vital  part  in  determining  the  frequency  of  operational  failures. 
Certainly,  the  vehicle  user  who  has  bean  informed  of  the  safe  operating 
limits  and  is  trying  to  observe  these  limits  will  experience  fewer  failures 
than  the  uninformed  user.  Abandonment  of  the  concept  of  limit  conditions 
would  have  to  be  considered  to  bn  a  serious  deficiency  in  the  proposed 
procedure. 

In  many  cases  there  is  no  direct  user  control  of  the  vehicle,  as  in 
the  case  of  missiles  lor  which  Reference  28  was  developed.  Even  jo,  limit 
conditions  should  be  defined  to  establish  the  interface  that  represents  the 
upper  limit  of  the  nr.r.nal  or  expected  situation  for  each  non- structural 
system.  As  discussed  on  psge  47,  the  causa  of  spy  failure  at  limit  condition 
or  lass  unquestionably  resides  somewhere  in  the  structural  system.  The 
capability  to  neke  such  decisions  contributes  to  the  practicality  and 
admlni'ttrability  of  the  Present  System. 

A  statement  is  mads  in  References  10  and  28  that  bears  on  the  basic 
philosophy  of  the  function  of  structural  design  criteria.  Ac  such  it 
warrants  a  tharoc^i  discussion,  even  though  the  otat ament  itself  is  relatively 
unimportant  to  the  understanding  of  ths  procedure.  The  statement  indicates 
that  by  the  use  of  a  snoarat*  facto*  on  sp*eu,  "the  designer  is  forced  to 
avoid  the  use  of  materials  tdilch  are  unduly  sensitive  to  temperature  changes." 
The  designer  any  recognise  this  sensitivity  as  undesirable  but  be  impelled 
to  bm  the  particular  mt  trial  by  other  requirements.  Structural  design 
critvvia  should  never  arbitrarily  proscribe  the  use  or  avoidance  of  a 
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particular  Material  or  structural  configuration.  Criteria  should  specify 
the  "performance"  required  of  the  structure  in  ouch  a  way  that  any  material 
could  be  used.  The  cost  In  weight  or  dollars  that  oust  be  paid  to  obtain 
the  specified  "performance"  may  make  it  very  logical  to  choose  one  material 
over  another  but  the  designer  should  have  the  option  to  make  the  decision. 

Reference  28  notes  that  "if  the  allowable  load  is  subject  to  variation 
or  error  due  to  tolerances,  speed,  and  angle  of  attack,  it  is  logical  to 
provide  for  these  possible  errors."  It  is  a  common  misconception  to  treat 
the  fact  that  there  exists  a  variation  in  some  quantity  affecting  a 
structural  system  as  though  the  variations  were  due  to  errors.  An  error 
implies  a  departure  from  what  is  right  or  proper,  possibly  even  carelessness. 
There  is  a  variation  in  the  height  of  humans,  but  this  variation  represents 
the  expected  or  normal  situation.  There  is  no  error  involved.  In  the  same 
vain,  a  variation  in  sheet  thickness  between  the  tolerance  values  could  not 
be  considered  to  be  an  error.  It  is  part  of  the  typical  production  process 
of  rolling  a  sheet  considering  wear  on  rolls  and  the  spring  of  the  rolls  at 
the  center  and  the  process  of  deciding  when  to  stop  a  production  run  and 
readjust  the  mill.  Cti  the  other  hand,  any  material  that  was  half  the 
specified  dimension  would  be  the  result  of  an  error.  It  would  not  be  a 
proper  variation  and  carelessness  would  presumably  be  involved. 

Proper  appreciation  of  this  concept  is  vital  to  the  determination  of 
exactly  what  should  be  considered  in  the  design  of  a  structural  system. 

It  would  be  the  grossest  kind  of  negligence  for  the  structural  designer  and 
analyst  to  ignore  expected  variations  in  structural  parameters.  However, 
there  should  be  a  very  limited  obligation  to  make  provisions  for  the 
structural  system  to  tolerate  and  survive  errors  in  the  fabrication,  main¬ 
tenance  and  operation  of  the  vehicle  system,  including  errors  in  the 
performance  of  non- structural  systems.  As  indicated  in  the  evaluation  of 
the  Present  System  in  Section  III,  it  is  one  of  its  deficiencies  that  the 
Present  System  does  not  clearly  delineate  those  errors  in  non- structural 
systems  that  are  obligatory  for  the  structural  system  to  survive  from  those 
it  is  not  expected  to  survive. 

The  most  significant  concept  in  the  approach  as  outlined  in  Reference 
28  is  the  idea  that  the  structural  design  should  consider  ultimate 
conditions.  Such  a  concept  represents  a  break  with  the  past.  Since  the 
adoption  of  factor  of  safety  as  a  concept,  structural  design  criteria  have 
not  required  (except  in  special  cases)  that  the  structure  be  responsible 
for  any  specific  operational  conditions  beyond  those  specified  as  limit 
conditions.  Adoption  of  a  policy  that  the  structural  system  does  have  such 
a  responsibility  should  not  be  done  without  serious  consideration  of  all 
the  ramifications.  The  concept  has  mnitfi  logic  behind  it  and  was,  in  fact, 
recommended  by  the  authors  of  this  critique  in  References  4  and  5. 
Implementation  of  the  concept  would  be  subject  to  many  serious  problems. 

It  is  questionable  whether  the  applied  loads  (i.e.,  the  loads  that  actually 
occur)  at  ultimate  conditions  can  be  accurately  coagnxted  using  present 
state-of-the-art  methods.  The  calculations  would  necessarily  include  the 
effects  of  yielding  which  would  affect  the  j,~:  'elastic  situation.  The 
ultimate  condition  might  represent  an  unstable  condition  in  which  it  would 
be  difficult  to  decide  how  to  balance  the  forces  acting  on  the  vehicle. 

There  would  inevitably  be  questions  on  how  quickly  the  vehicle  traversed 
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the  rang*  “ron  Unit  to  ultimate  oonditiona  sines  thia  would  affect  tha 
teaporaturs  transients  on  the  structure  and  the  failing  strength  of  the 

structure. 

Verification  of  the  confuted  loads  would  he  a  difficult  if  not 
impossible  objective  of  a  test  program.  In  the  extreme,  each  ultimate 
condition  verified  might  result  in  tha  lose  of  the  teat_  vehicle.  Proof 
of  compliance,  which  is  emphasized  throughout  Section  ill  ae  vital, 
might  be  impractical  for  all  classes  of  vehicles  but  particularly  for 
manned  vehicles.  If  the  verification  of  ultimate  conditions  and  ultimate 
loads  by  flight  test  ia  not  feasible  and  if  there  is  no  limit  condition 
defined  that  could  be  verified,  there  ia  no  objective  basis  for  deciding 
what  constitutes  a  fully  qualified  structural  system.  Until  the  question 
is  examined  in  all  its  aspects  and  used  In  the  design  of  many  vehicles, 
not  just  to  one  flight  vehicle,  universal  adoption  of  the  concept  might  be 
akin  to  opening  Pandora's  Box.  Finally,  the  cost  involved  in  implementing 
the  procedure  in  the  design  of  any  new  vehicle  would  undoubtedly  be 
significantly  greater  than  under  the  Present  System.  Thie  of  course,  is  a 
major  consideration  in  the  practicality  of  the  procedure. 

Evaluation  of  the  modified  factor  of  safety  procedure  by  the  standards 
listed  in  Section  4-3  results  in  the  following  conclusions : 

1.  The  procedure  doee  not  have  a  clearly-defined  quantitative 
objective  that  ie  expected  to  be  satisfied.  The  three  factors 
suggested  are  empirical  and  may  or  may  not  produce  a 
satisfactory  structural  system.  Chce  adopted,  the  three 
factors  would  become  so  embedded  in  specifications  that 
there  would  be  no  way  to  justify  ary  changes  to  the  values. 

Che  of  the  problem  areas  in  the  Present  System  where  the 
Reference  28  procedure  offers  an  improvement  is  the  question 
of  the  design  temperatures  for  the  structure. 

2.  The  Actual  State  of  the  structural  system  would  be  deter¬ 
mined  in  much  the  same  manner  as  described  in  Section  II 
and  as  shown  on  Figure  10.  The  evaluation  of  the  Actual 
State  Information  System  for  the  Present  (Factor  of 
Safety)  Structural  Design  System  in  Section  III  would  be 
applicable  generally  to  the  procedure.  The  Strength  Test 
Stage  shown  on  Figure  13  could  be  accomplished  in  much  the 
same  fashion  as  at  present.  The  Flight  Test  Stags  would 
necessarily  bs  changed  and  there  would  be  no  specific  flight 
conditions  that  could  bs  demonstrated  nor  would  there  be  a 
specifiable  verification  of  deeign  loads  anymore. 

3.  The  procedure  will  be  about  the  equivalent  of  the  Present 
System  ae  evaluated  in  Section  III  for  capability  to 
provide  an  early  disclosure  of  possible  strength  discrep¬ 
ancies  between  Desired  State  and  Actual  State.  Since  it 
will  not  usually  be  feasible  tc  compare  Actual  Loads  at 
specified  design  conditions  with  the  Desired  State  loads, 
there  can  be  no  comparison  end  disclosure  of  error.  The 


-  119  - 


procedure  win  be  severely  handicapped  because  of  this 
loss  in  error  disclosure  capability. 

Although  differences  of  opinion  regarding  the  procedure  were  noted,  it 
should  be  understood  that  this  procedure  is  considered  to  be  the  best  —  the 
most  practical  —  the  most  logical  —  of  all  the  papers  reviewed  in  this 
critique.  Reference  28  is  one  of  the  few  recognizing  either  explicitly  or 
implicitly,  most  of  the  elements  associated  with  a  completely  rational,  and 
objective  structural  design  system. 

4.5  SUMMARY  OF  CRITIQUES 

Fourteen  different  approaches  to  the  problems  of  structural  reliability, 
structural  design  criteria  and  structural  design  procedures  have  been 
evaluated  in  this  critique.  These  papers  are  considered  to  be  a  representative 
cross  section  of  the  methods  extant  in  the  technical  literature.  All  but  one 
of  the  documents  evaluated  have  the  common  characteristic  of  considering  that 
the  calculated  or  assumed  load  and  strength  distributions  are  "known" 
distributions.  As  such,  these  approaches  can  be  categorized  as  Purely 
Statistical  Structural  Reliability  Systems  as  described  in  Sections  II  and 
III.  The  remaining  paper  is  categorized  as  a  modification  of  the  Present 
(Factor  of  Safety)  Structural  Design  System  described  in  Sections  II  and  III. 

The  thirteen  papers  that  are  grouped  together  as  Purely  Statistical 
Structural  Reliability  Systems  have  the  same  characteristics  as  the  basic 
system  of  this  type.  As  a  result,  the  evaluation  in  Section  3.4  is  generally 
applicable  to  each  of  the  thirteen  papers.  In  that  section  it  was  noted 
that  the  principal  deterrent  to  the  adoption  of  a  Purely  Statistical 
Structural  Reliability  System  is  the  fact  that  there  is  no  procedure  avail¬ 
able  for  accurately  determining  the  actual  structural  reliability  of  a 
particular  structural  design.  Analytical  calculation  i3  not  sufficiently 
accurate  to  3erve  as  the  sole  determinant  of  structural  reliability. 
Experimental  determination  of  structural  reliability  is  not  feasible  for 
the  structural  reliabilities  usually  considered  for  aerospace  vehicles.  As 
a  result,  tnere  is  no  proof  of  compliance  technique  that  would  be  satisfactory 
for  demonstration  that  a  contractual  requirement  had  been  fulfilled.  None  of 
the  approaches  critiqued  dn  Section  4*4a  contain  any  solution  to  the  problem, 
so  it  must  be  considered  that  none  of  these  procedures  is  practical  for  the 
design  of  aerospace  vehicles. 

In  summarizing  the  critique  of  the  14  papers  by  the  standards  of 
Section  4.3  >  it  is  apparent  that  most  of  the  papers  have  similar  character¬ 
istics.  Nearly  all  of  the  papers  have  defined  the  Desired  State  in  terms  of 
a  quantitative  value  for  structural  reliability.  As  discussed  in  the 
critique  of  Reference  11  which  is  applicable  to  most  of  the  other  papers, 
there  are  two  common  problems  in  defining  structural  reliability  as  the 
Desired  State.  Che  is  to  formulate  a  rational  basis  for  the  choice  of  a 
particular  number  for  structural  reliability.  The  other  is  the  precise 
meaning  of  structural  reliability.  The  discussion  on  page  78  points  out 
that  there  are  three  orders  of  reliability.  These  are  the  reliabilities  for 
an  individual  vehicle,  those  for  the  group  of  nominally  identical  vehicles 
of  a  particular  design,  and  the  general  reliability  of  all  vehicles  of  all 
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designs  resulting  from  following  the  precepts  of  a  particular  design  system. 
While  it  is  considered  that  those  two  questions  must  be  resolved  in  the 
development  of  quantitative  structural  design  criteria  by  statistical  methods, 
there  should  be  no  great  difficulty  in  doing  ao. 

Several  of  tho  procedureo  present  an  additional  requirement  that  the 
required  structural  reliability  be  converted  into  a  total  probability  of 
failure  which  is  allocated  to  the  individual  components  of  the  struetc^al 
system.  Where  this  approach  la  followed,  there  is  an  implicit  assumptiv 
that  tho  probability  of  failure  of  the  total  system  is  equal  to  the  bus  01 
the  probabilities  of  failure  of  the  individual  components.  The  assumption 
is  not  a  tenable  one  in  most  structural  situations.  It  is  not  generally 
recognized  that  the  increment  a  single  component  contributes  to  tho  total 
must  be  based  on  a  conditional  reliability.  This  conditional  reliability  is 
expressed  as  the  probability  of  failure  of  the  component  given  that  all  the 
other  components  have  survived.  The  problem  is  discussed  at.  length  on  page 
104. 


Two  of  the  papers,  References  28  and  29,  defino  design  ultimate  loads 
directly  from  operational  conditions  rather  than  as  limit  loads  multiplied 
by  a  Factor  of  Safety,  Reference  28  specifically  defines  ultimate  conditions. 
Such  a  concept  represents  a  break  with  the  paet.  Moption  of  a  policy  that 
ths  structural  system  has  an  explicit  responsibility  to  survive  beyond 
specified  limit  conditions  should  not  be  done  without  serious  consideration 
of  all  the  ramifications,  some  of  which  are  discussed  on  page  118-  ihe  idea 
of  defining  ultimate  loads  directly  rather  than  as  factored  limit  loade 
retains  the  advantage  of  presenting  the  structural  design  criteria  in  a 
dsterminiatic  form  that  can  be  administered.  Reference  29  uses  a  rational 
probability  analysis  technique  for  defining  the  Design  Ultimate  Load.  The 
baeic  philosophy  of  defining  the  ultimata  conditions  from  statistical 
considerations  but  designing  to  these  conditions  as  deterministic  require¬ 
ments  is  undoubtedly  the  moat  rational  and  practical  approach  available. 

Several  of  the  papers  reviewed  in  the  critique  expressed  tho  thought 
that  it  is  desired  that  the  structural  system  survive  all  loads  that  may  be 
encountered.  Such  an  objective  is  unrealistic  if  the  structural  system  is 
to  be  light  enough  to  permit,  the  vehicle  to  perform  a  useful  function.  It 
should  not  be  the  function  of  the  structure  to  survive  any  conceivable  gross 
overload  including  situations  precipitated  by  failure  of  non- structural 
systems.  Neither  should  it  be  the  intention  that  the  structure  should 
tolerate  any  conceivable  gross  error  in  ths  design,  fabrication  and  main¬ 
tenance  of  the  structure.  Structural  design  criteria  should  identify  and 
define  the  interface  -.  with  non-structur&l  systems.  It  should  be  the 
responsibility  of  ths  structural  system  to  prevent  vehicle  failures  for  a 
limited  range  of  operational  conditions  and  the  responsibility  of  other 
non-st ructvral  systems  to  prevent  vehicle  failures  outside  the  range  by 
avoiding  conditions  ths  structure  cannot  survive. 
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SECTION  V 


CONCLUSIONS 

Present  end  proposed  approaches  to  structural  design  criteria  ere 
evaluated  in  this  critique.  Thr,  evaluation  is  accomplished  in  three  steps. 
First,  a  discussion  and  analysts  is  presented  to  develop  an  understanding 
of  the  various  functions  that  contribute  to  a  structural  dosign  system. 

Second,  standards  of  evaluation  ere  established  and  two  basic  structural 
design  systems  are  evaluated  by  these  standards.  Third,  a  group  of  papers, 
considered  to  be  a  representative  erps<s  section  of  the  structural  reliability 
methods  extant  in  the  technical  literature,  are  reviewed  ar.d  compared  to  the 
two  basic  systems. 

Section  II  introduces  Professor  Draper's  informatics  concept  to  the 
study  of  structural  design  systems.  This  concept  provides  the  framework  for 
clarifying  the  purpose  of  the  various  functions  that  contribute  to  a 
structural  design  system.  It  also  provides  an  unparalleled  opportunity  to 
dispassionately  discuee  the  strong  points  and  weaknesses  of  each  system. 

It  is  expected  that  this  type  of  analysis  will  illuminate  the  structural 
design  problem  and  will  be  most  useful  when  it  is  applied  to  future  proposals 
for  changing  the  present  structural  design  system. 

Section  III  converts  the  understanding  of  the  functions  of  a  structural 
design  system  into  an  evaluation  of  the  merits  and  the  problem  areas 
associated  with  the  two  basic  structural  design  systsms.  These  two  systems 
are  the  Present  (Factor  of  Safety)  Structural  Deeign  System  and  a  hypothetical 
Purely  Statistical  Structural  P.eliability  System. 

In  Section  III  it  is  concluded  that  the  Present  (Factor  of  Safety) 
Structural  Design  System  is  a  generally  satisfactory  system  for  the  design 
of  aerospace  vehicles.  However,  there  are  some  problem  areas  that  will 
become  more  apparent  as  advanced  missions  require  the  use  of  new  structural 
configurations  and  materials.  A  Purely  Statistical  Structural  Reliability 
System  is  not  practical  for  the  design  of  aerospace  vehicles.  Since  there 
ie  no  way  to  accurately  measure  structural  reliability,  it  is  not  possible 
to  write  a  definitive  contract  requiring  demonstration  of  a  specified 
structural  r suability. 

The  fundamental  problem  area  in  the  Present  system  resides  in  the  fact 
that  there  is  no  clearly  identifiable,  quantitative  objective  that  the 
Present  System  is  expected  to  satisfy.  In  most  cases  a  high  degree  of 
structural  integrity  has  resulted  from  an  indirect  and  sometimes  intuitive 
consideration  of  those  characteristics  that  are  a  prerequisite  to  consistent 
structural  survival.  Such  things  as  ductile  materials  and  a  general 
insensitivity  to  minor  discrepancies  In  the  structure  have  been  provided 
by  state-of-the-art  structural  practices.  In  those  few  oases  where  problems 
did  occur,  ths  requirements  were  changed  in  reaction  to  the  problem.  There 
ie  an  implicit  assumption  that  future  etructural  systems  will  have  the  same 
characteristics  as  past  systsms.  This  is  not  neoessarlly  a  valid  assumption. 
In  particular,  current  trends  indicate  that  many  future  systems  will  have  a 
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much  larger  coefficient  of  variation  in  strength  than  has  been  customary  in 
the  past.  Also,  most  space  vehicles  will  not  receive  the  extensive  flight 
loads  testing  that  has  been  customary  with  aircraft.  Both  of  these  conditions 
tend  to  degrade  the  power  of  the  strength  and  loads  tests  to  disclose  errors 
in  the  analysis. 

Another  result  of  the  lack  of  a  clearly  identifiable  objective  is  that 
there  is  no  logic  available  that  can  resolve  questions  such  as  a  request  to 
lower  the  factor  of  safety  from  1.5  to  1.4.  There  is  great  need  for  a 
criterion  by  which  to  judge  such  questions  objectively. 

In  some  of  the  newer  structural  design  areas,  such  as  fatigue  and  high 
temperatures,  the  factor  of  safety  concept  is  not  directly  applicable  to  the 
definition  of  structural  design  requirements.  There  is  even  more  need  to 
clearly  define  the  objectives  of  the  structural  design  system  for  these 
problems  than  there  is  for  the  problems  that  the  Present  System  conventionally 
considers.  Coupled  with  the  definition  of  an  objective  must  be  practical 
procedures  for  determining  the  Actual  State  pnd  for  proof  of  compliance  with 
the  stated  objectives. 

In  situations  where  a  structural  failure  does  occur,  the  deterministic 
nature  of  the  Present  System  permits  the  determination  of  a  cause  of  failure, 
responsibility  for  the  failure,  and  corrective  action.  However,  many  of  the 
interfaces  between  the  structural  system  and  other  systems  are  not  explicitly 
defined.  Therefore,  responsibility  for  some  of  the  areas  contributing  to 
structural  integrity  is  not  recognized  until  aftsr  a  failure  occurs. 

The  principal  deterrent  to  the  r doption  of  a  Purely  Statistical 
Structural  Reliability  System  is  the  fact  that  there  is  no  procedure  for 
accurately  determining  the  actual  structural  reliability  of  a  particular 
structural  design.  As  a  result  there  is  no  proof  of  compliance  technique 
that  would  be  satisfactory  for  demonstration  that  a  contractual  requirement 
ha3  been  fulfilled. 

As  a  derivative  of  the  problem  of  determining  the  value  representing 
the  actual  structural  reliability  of  a  vehicle,  there  is  the  problem  of 
determining  a  cause  and  assigning  responsibility  when  structural  failures  do 
occur.  When  cause  and  responsibility  are  not  determinable,  neither  is  the 
corrective  action. 

In  Section  IV,  fourteen  documents  on  the  subject  of  structural 
reliability  and  structural  design  criteria  are  evaluated.  All  but  one  of 
the  documents  evaluated  have  the  common  characteristic  of  assuming  that  the 
calculated  or  assumed  load  and  strength  distributions  are  known  distribu¬ 
tions.  As  3uch,  these  approaches  can  be  categorized  as  a  Purely  Statistical 
Structural  Reliability  System.  In  Section  III  it  is  concluded  that  such  a 
system  is  not  practical  for  the  design  of  aerospace  vehicles. 

The  procedure,  defined  in  References  10  and  28,  is  a  modified  factor 
of  safety  approach.  In  the  discussion  of  the  procedure,  it  is  concluded 
that  the  approach  is  considered  to  be  the  best  —  the  most  practical  — 
the  most  logical  —  of  all  the  papers  reviewed  in  this  critique.  This 
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paper  is  one  of  the  few  recognizing,  either  explicitly  or  implicitly,  most,  of 
the  elements  associated  with  a  completely  rational  and  objective  structural 
design  system.  However,  the  detail  evaluation  diecuesee  several  problems 
associated  with  the  procedure  that  prevent  an  acceptance  of  th6  procedure  ir. 
its  present  form  as  a  valid,  practical  asethod  for  the  definition  of  quanti¬ 
tative  structural  design  criteria  by  statistical  methods. 

Aa  a  result  of  the  evaluation  of  14  different  presentations  of 
approaches  to  the  structural  reliability  problem,  this  critique  concludes 
that  none  of  the  known  approaches  in  the  literature  today  provides  a 
satisfactory  foundation  for  quantitative  structural  design  criteria  baaed 
on  statistical  methods. 

If  it  is  desired  to  provide  the  Present  System  with  a  quantitative 
objective  ana  with  the  capability  to  systematically  resolve  the  problems 
associated  with  structures  for  advanced  vehicles,  a  new  structural  design 
system  is  needed.  The  now  procedure  should  retain  the  deterministic  type 
of  requirements  that  give  the  Present  System  its  practicality  and 
adrainistrability.  The  deterministic  requirements  crh  be  established  in  such 
a  way  that  they  correspond  to  a  structural  reliability  goal  without  having  to 
prove  directly  that  the  goal  has  been  achieved.  In  such  an  approach,  all  of 
the  elements  effecting  structural  reliability  can  be  consistently  directed 
towards  achieving  a  quantitatively-defined  structural  reliability  goal  without 
introducing  the  impossible  problem  of  proving  compliance  with  a  structural 
reliability  requirement.  Nine  characteristics  that  should  be  incorporated  in 
a  modification  of  the  Present  System  are  recommended  in  Section  3.6,  page  72. 
The  procedure  described  in  Volumes  II  and  III  of  this  report  was  developed 
with  the  intention  of  satisfying  the  recommendations  of  Section  3.6. 
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APPENDIX 


The  behavior  of  the  numerical  value  of  the  probability  of  failure  (Pp) 

&a  a  function  of  the  coefficient  of  strength  variation  (yfl)  and  other 
significant  parameters  is  often  considered  to  be  rather  mysterious  by  those 
who  have  not  had  the  opportunity  to  study  the  question  carefully.  As  a 
result,  the  Pp  calculations  necessary  for  any  structural  reliability  (SR) 
calculation  are  often  viewed  with  a  somewhat  jaundiced  eye  by  the  practical 
engineer.  Experience  has  shown  that  it  is  relatively  easy  to  explain  the 
behavior  of  Pp  curves  of  which  those  on  Figure  23  in  Section  4.4a(4)  are 
typical.  Values  for  these  curves  were  generated  by  the  computer  program 
described  in  Volume  III.  The  technical  background  for  this  program  is 
developed  in  Section  2.3  of  Volume  II. 

Curve  (l)  is  the  simplest  to  explain  so  this  will  be  considered  first. 

It  is  assumed  that  the  load  and  strength  distributions  are  known;  that  is, 
there  is  no  analytical  error.  This  condition  is  represented  by  inputting 
the  control  number  K2  «  11.  As  explained  in  Volume  III,  the  program  then 
computes  the  Pp  with  a  routine  appropriate  to  that  assumption.  All  of  the 
values  on  Figure  23  are  based  on  a  loading  spectrum  which  has  its  mean  at 
the  limit  load  and  which  has  a  probability  of  exceeding  the  ultimate,  or 
omega  load,  of  10“3.  Limit  load  is  assumed  to  have  a  value  of  100  and  the 
typical  factor  of  safety  of  1.5  means  that  the  ultimate  load  is  150.  The 
probability  of  exceeding  the  load  at  various  levels  is  printed  out  as  FELXI 
for  the  various  cases  shown  on  Figures  A-l  through  A-7.  Since  the  computer 
program  prints  out  only  in  the  region  that  contributes  significantly  to  the 
total  Pp,  Figure  A-l  does  not  show  that  PBLXI  is  0.5  when  XI  is  100.  However, 
this  is  shown  on  Figure  A-4  which  has  the  same  loading  distribution.  Figure  A-l 
does  show  that  the  probability  of  exceeding  the  ultimate  load  at  150  is  .001, 
which  is  consistent  with  the  assumptions  on  which  Figure  23  is  based. 

Case  1,  Figure  A-l,  represents  a  situation  where  the  Vs  is  very  small  — 
approaching  zero.  The  basic  assumption  is  that  the  strength  allowable  is  a 
99-percen'r -exceed  value,  as  indicated  by  SIGALL  equal  to  2.3263  (note  Figures 
5  and  6  in  Volume  3).  This  value  is  matched  to  the  ultimate  load  of  150  so 
the  mean  strength  is  slightly  higher  as  shown  by  the  printout  of  AMUT  equal 
to  150.3497  for  Case  1,  Most  of  the  systems  of  this  design  would  have  their 
strengths  between  the  upper  and  lower  99-percent  levels  of  the  strength 
distribution.  The  lower  level  is  already  established  at  150  and  the  upper 
level  is  the  same  distance  on  the  other  side  of  the  mean  or  at  150.6994.  Most 
of  the  contribution  to  the  total  Pp  should  be  between  these  two  values.  Note 
in  Case  1  that  only  1006  out  of  the  total  of  92612  units,  or  about  one  percent, 
is  contributed  to  the  total  up  to  XI  equal  to  149.99.  The  Pp  at  150.71  is 
already  92032  of  the  total  of  92612  so  less  than  one  percent  is  added  beyond 
that  point. 

Since  almost  all  the  strength  is  concentrated  very  close  to  the  ultimate 
load  of  150  vrhich  has  a  probability  of  being  exceeded  of  10"3,  the  probability 
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of  failure  is  close  to  10“^.  The  left  hand  end  of  Curve  (l)  on  Figure  23 
approaches  10“3  as  7g  approaches  zero. 

As  yg  becomes  larger  the  situation  changes  somewhat.  Ca3e  2,  Figure  A-2, 
shows  this.  When  y„  equals  0.03  the  mean  strength  must  be  higher  than  150  in 
order  to  have  the  99-percent-exceed  strength  at  150.  Case  2  shows  AMUT  as 
161.2537.  The  strength  range  is  now  from  150  to  172.  If  the  strength  is 
imagined  to  be  concentrated  temporarily  all  at  the  mean  (l6.l),  where  FEUI  is 
about  lO-^,  the  Pp  would  be  that  value.  Actually,  the  loads  on  the  low  side 
of  the  mean  are  more  likely  to  be  exceeded  than  those  on  the  high  side.  As  a 
result,  the  strengths  on  the  low  side  of  the  mean  add  to  Pp  more  rapidly  than 
those  on  the  high  side  subtract  from  the  value  that  would  do  obtained  if  all 
the  strengths  were  at  the  mean.  The  total  P^  increases  somewhat  and  the 
distribution  of  the  failures  shifts  so  it  is* not  centered  about  the  mean 
strength,  but  rather  is  on  the  low  side  of  the  mean.  The  range  of  the 
failure  distribution  is  now  between  about  145  and  165.  Thus,  the  mean  of  the 
failure  distribution  has  moved  up  from  approximately  150.3  for  Case  1  to  155 
for  Case  2,  and  the  range  of  significant  contribution  to  tho  Pp  value  has 
widened  out  substantially  for  Case  2.  Very  roughly,  the  Pp  could  be  estimated 
by  assuming  that  the  effective  mean  strength  is  about  half-way  between  the 
true  mean  of  161  and  the  99-percent-exceed  point  at  150.  H5LXI  at  this  half¬ 
way  point  is  3  x  10“^  which  is  a  reasonable  approximation  of  the  value 
computed  for  Case  2  with  yg  equal  to  0.03.  This  may  help  explain  why  Pp 
decreases  initially  as  yg  increases  from  zero. 

As  >g  continues  to  increase,  Figure  23  shows  that  Pp  reaches  a  minimum 
on  Curve  (l)  when  yg  is  approximately  0.07.  Case  3,  Figure  A-3,  shows  thi3 
situation.  The  mean  continues  to  increase  in  order  to  hold  the  99-percent- 
exceed  allowable  at  150.  For  this  case  AMUT  equals  179.1774.  The  range 
where  most  of  the  mailing  strengths  are  concentrated  is  now  from  150  to  about 
208.  If  all  the  strengths  were  concentrated  at  the  mean  where  HSLXI  is  about 
5  x  10~7}  the  Pp  would  be  that  value.  As  noted  before,  the  loads  on  the  low 
side  of  the  mean  are  very  much  more  likely  to  be  exceeded  than  those  on  the 
high  3ide.  Therefore,  the  contributions  to  Pp  reach  a  peak  near  149.50  as 
shown  by  the  .DELFF  increments  on  Figure  A-3 .  The  load  probabilities  from  179 
on  up  are  more  than  three  orders  of  magnitude  lower  than  they  are  at  150,  so 
the  probability  of  failure  in  this  region  becomes  negligible  relative  to  the 
total  Pp.  As  a  result,  the  failure  distribution  is  essentially  from  125  to 
175.  If  all  the  strengths  were  concentrated  at  about  162  where  FELXI  is 
about  5  x  10-5,  the  Pp  would  be  this  same  value.  Since  this  is  the  Fy  shown 
in  the  computations  of  Figure  A-3,  the  effective  strength  again  is  close  to 
the  half-way  point  between  the  99-percent-exceed  point  and  the  mean  strength. 
This  rule  of  thumb  furnishes  a  reasonable  approximation  of  Pp  as  long  as 
is  relatively  small. 

These  three  cases  show  that  it  is  reasonable  and  to  be  expected  for  the 
Pp  to  decrease  as  yg  increases  as  long  as  yg  remains  relatively  low  (below 
0.10,  for  example).  This  decrease  in  Pp  is  due  to  the  movement  of  the  mean 
strength  to  higher  values  which  are  less  likely  to  occur.  However,  even  in 
Caue  3  where  y„  equals  0.07,  the  contribution  of  failures  below  150  have 
become  over  half  the  total.  As  yg  continues  to  increase  this  trend  is 
accelerated.  As  the  mean  continues  to  move  higher  and  the  probability  of 
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strength  mean  becomes  very  low,  more  and  more  of  the  failure  distribution 
occure  at  very  low  values  of  XI. 


Case  U,  where  y&  equals  0,22*.  illustrates  this  situation.  It  should  be 
noted  that,  th©  mean  cruet  be  at  339.6060  in  order  to  place  the  99-psrcant- 
»AC««d  value  at  150.  As  a  result  a  negligible  amount  of  the  total  P»  is 
contributed  by  those  strengths  above  150,  even  though  99  percent  of  the 
strengths  *r«  in  thin  region.  From  the  geometry  of  the  Gaussian  distribution 
the  area  below  tha  100  valua  corresponds  to  0.0016.  The  probability  of 
exceeding  this  load  is  0.5  so  the  incremental  Pp  up  to  100  must  be  at  least 
0.5  x  0.0016  ■»  0.0008.  Since  the  values  of  FELxI  helow  100  are  greater  than 
0.5  and  approach  1.0.  the  incremental  Pp  should  be  somewhat-  larger  than 
0.0008.  The  printout  on  Figure  A-4  shows  it  is  about  0.0013.  It  can  be 
seen  that  the  failure  increment  below  100  is  already  over  20  times  the 
total  Py  when  va  equals  0.07.  Thuo,  it  must  be  realized  that  when  >'a  becomes 
large,  most  of  the  failures  are  due  to  those  strengths  which  are  leea  than 
100.  This  accounts  for  the  rise  in  Pp  between  the  ys  values  of  0.07  and 
0.24  as  shown  on  Figure  23.  Incidentally,  if  >'e  increased  still  further, 
the  proportion  of  strengths  below  100  would  increase  still,  more  and  Pp  would 
continue  to  rise.  However,  99  percent  of  the  strengths  exceed  150  by  the 
conditions  of  the  problem  so  this  sets  an  upper  limit  on  Pp.  The  number 
below  100  must  always  be  less  than  0.01.  30  the  incremental  Pp  must  be  lass 
than  0.01.  This  means  that  as  Curve  (ij  on  Figure  23  is  extended  to  the 
right,  it  would  become  assyinptotic  to  and  bt low  the  10“ 2  iin8. 

The  reason  Curve  (2)  on  Figure  23  is  so  high  is  because  of  the 
introduction  of  consideration  of  the  probability  that  there  will  be  errors 
in  the  strength  analysis.  This  means  that  the  actual  mean  strength  of  the 
structural  system  may  be  much  below  the  intended  strength.  This  situation 
is  discussed  at  great  length  in  Volumes  II  and  III.  Suffics  it  to  say  hero, 
that  it  is  assumed  that  tha  error  function  is  the  same  as  in  the  past  as 

defined  on  Figure  5  of  Volume  II.  This  indicates  that  about  13  percent  of 

the  designs  will  fail  at  limit  load  or  less  on  their  first  loading  after 
analytical  design.  If  such  designs  are  used  in  operational  vehicles  without 
the  benefit  of  strength  testing,  the  same  percentage  could  be  expected  to 
fail  at  limit  load  or  less  during  operations.  By  the  same  reasoning  as  used 
In  Case  3,  it  can  be  concluded  that  the  incremental  failure  rate  up  to  100 
should  be  greater  than  0.5  x  0.13  =  O.O65.  The  value  shown  on  Figure  A-5 
is  about  0.09  with  the  total  being  0.124.  The  basic  phenomenon  here  is  that, 
when  there  is  no  strength  teat  to  disclose  errors,  the  total  probability  of 

failure  is  closely  tied  in  to  tha  probability  that  there  will  be  an  analytical 

error  large  enough  to  bring  the  mean  strength  below  the  limit  load.  This 
error  function  represents  a  completely  different  distribution  than  the  strength 
distribution  about  a  known  mean  strength.  Accordingly,  P^-  for  the  situation 
where  strength  errors  in  analysis  are  recognized  and  integrated  into  Pp 
becomes  essentially  independent  of  Ya  as  shown  on  Curve  2  of  Figure  23  when 
no  strength  tests  are  conducted. 


Curve  3  represents  the  typical  situation  for  aerospace  vehicles.  The 
error  function  is  included  but  or.e  strength  toot  is  conducted  which  will 
disclose  the  analytical  errors  with  varying  degrees  of  certainty  depending 
on  Ya.  Case  6,  Figure  A-6,  shows  the  improvement  in  Pp  from  Case  5.  It  is 
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not  as  good  as  Case  3  where  perfect  analytical  accuracy  is  assessed  but  the 
Pp  is  0.00114  which  is  only  slightly  higher  than  the  desired  value  of  10~^. 

The  basis  for  the  decrement  in  Pp  from  Curve  (2)  to  Curve  (3)  on  Figure  23 
i3  discussed  in  Section  2 . 3d  Cl )  of  Volume  II  and  represented  pic tori ally  on 
Figure  10  of  that  Yqlume.  It  is  noted  therein  that  it  becomes  highly 
unlikely  that  a  system  whose  mean  is  at  100  will  survive  the  strength  test 
to  150.  The  error  is  disclosed  with  a  high  degree  of  certainty.  Case  6 
reflects  this  since  the  incremental  Fp  at  10o  is  about  10~?  whereas  in 
Case  5  with  no  test  the  value  is  0.09. 

As  noted  in  the  discussion  in  Section  2.3d(2)  of  Volume  II,  the  error 
disclosure  is  much  less  certain  when  Ys  is  large.  As  a  result,  the  incremental 
Pp  at  100  increases  to  0.0087  when  YB  is  0.24  and  the  total  Fy  is  0.0135=  Most 
of  tho  failures  in  this  situation  occur  between  60  and  120.  They  are  due  to 
structures  whose  mean  is  near  120,  which  would  mean  that  there  is  a  0.15 
probability  of  surviving  the  test  to  150  even  though  the  mean  at  120  i3  only 
about  one-third  of  the  intended  value  of  339.6060.  This  relatively  hifrh 
chance  of  an  understrength  design  passing  the  test  to  ultimate  load  accounts 
for  the  significant  increase  in  Pp  as  ys  goes  from  0.07  to  0.24.  Section 
2.3d (3)  of  Volume  H  discusses  how  this  difficulty  is  overcome  by  testing  to 
a  load  higher  than  150  when  yg  is  large. 
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the  proc  a  dure  and  presents  user’s  instructions  for  the  program. 

The  critique  of  Volume  I  concludes  that  none  of  the  approaches  in  the  literature 
today  provides  a  satisfactory  foundation  for  quantitative  structural  design 
criteria  based  on  statistical  methods. 

This  document  is  subject  to  special  export  controls  and  each  transmittal  to 
foreign  nationals  or  foreign  governments  may  be  made  only  »<ith  prior  approval  of 
the  Air  Force  Flight  Dynamics  Laboratory  (FDTR),  Wright-Pav  terson  AFB,  Ohio  45433 1 
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